text: End Point Security: We allow access to all information assets only from authorized and standard devices (endpoints). All endpoints have a next-generation anti-virus tool installed that uses a combination of artificial intelligence, behavioral detection, and machine learning algorithms to anticipate and prevent known and unknown threats. All endpoints also have an extended detection and response ("XDR") tool installed that provides a proactive approach to threat detection and response by collecting and correlating data across multiple security layers. Alerts from all these tools are actively monitored and appropriate alerts/escalations are issued. International Seaways, Inc.


text: Data Security: The core objective of our cybersecurity program is securing the Company's sensitive data across all information assets while maintaining appropriate access for authorized personnel. To prevent any accidental data loss, we strictly follow the principle of "least privilege," and limit users' access rights to only what is required to do their jobs. Further, all the disks are encrypted, and daily backups of all computers are maintained outside the Company's network.

companyName: International Seaways, Inc.

ticker: INSW

secItem: Item 1C


text: We maintain a detailed incident response plan to identify, manage, investigate, and remediate various types of cybersecurity incidents. This plan provides organizational and operational structures, processes, and procedures to allow responsible personnel to initiate and execute a proper response to cybersecurity incidents that may affect the function and security of IT assets, information resources, and business operations. The plan describes the processes for cybersecurity incident severity assessment, materiality determination, roles and responsibilities for the incident response team members, and necessary alerts and notifications.


text: The plan is regularly updated, reviewed by management, and tested yearly involving relevant stakeholders so that all are familiar with their roles and responsibilities in case of a cyber incident.


text: We routinely review the effectiveness of our cybersecurity program using the applicable CIS Critical Security Controls and take necessary actions.


text: We employ external independent experts to review and test the effectiveness of our cybersecurity processes, and protection and detection mechanisms. The findings are reviewed by management and approved changes are prioritized and implemented.


text: We have a retainer agreement with a reputable cyber incident response team, who assists the Company in reviewing the cyber incident response plan and conducting yearly tabletop drills. The experts on the cyber incident response team are available on a priority basis to assist the Company with forensics and other sophisticated analyses and investigations in case of a cyber incident for quick response and efficient recovery.


text: We have insurance coverage for losses and expenses related to liability, privacy and regulatory actions, incident response, business interruption, data recovery, hardware replacement, extortion, and reputational harm arising from potential cybersecurity incidents.


text: Cybersecurity Incidents Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three fiscal years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Our cybersecurity risk management program is managed by the Chief Information Security Officer (the "CISO") and overseen by the Chief Executive Officer and the Chief Administrative Officer. Our CISO has over 25 years of experience in maritime IT. He holds an MBA and a Master of Science degree in Information Management and is a Certified Information Security Manager from the Information Systems Audit and Control Association, certified in Cybersecurity Risk Management by Harvard University, Cybersecurity Oversight by Carnegie Mellon, and Maritime Cybersecurity by Lloyds Maritime.


text: The CISO and other members of the IT security team actively participate in maritime-specific as well as other broader cybersecurity groups for collaboration on cyber resilience, threat intelligence sharing, and best practices exchange. All the members of the IT security team regularly undergo new training/certifications on cybersecurity and attend seminars/conferences related to cybersecurity to keep their knowledge and expertise current. The CISO meets with the Chief Executive Officer of the Company monthly, and more frequently if warranted, to provide updates on cybersecurity programs, threats, and incidents.


text: Board of Directors The Corporate Governance and Risk Assessment Committee (the "Governance Committee") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the Governance Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISO. The Chairman of the Governance Committee provides quarterly reports of such updates to the full Board of Directors. The CISO's quarterly report to the Governance Committee contains updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.


text: Risk Management and Strategy Our Cybersecurity Approach and Integration Technology is a fundamental element in our Company's permanent engagement with innovation and continuous improvement in the area of risk management and cybersecurity management strategy. As cybersecurity threats are becoming increasingly sophisticated and rapidly evolving, we have implemented processes for overseeing and identifying material risks from potential cybersecurity threats. Cyber risk management is a core component of our Company's governance structure, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. Our primary focus is information security.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Our Information Technology governance framework is composed of policies, procedures, standards, and methodologies to identify and manage risks among other aspects, which are governed by reference frameworks and best practices.


text: SCC's information security strategy is led by the Technology and Information Security Director ("TISD"), with review and support from the Chief Information Security Officer ("CISO") of Grupo Mexico. The main purpose of SCC's information security strategy is to identify and manage technological risks that could affect the Company's objectives and to strengthen our Company's resilience. As part of management's oversight of cybersecurity, the information security strategy is presented on an annual basis to SCC's Audit Committee of the Board of Directors, which reports to the full Board of Directors, with additional review and oversight by AMC's Risks Committee. In addition, we conduct a quarterly follow-up of our cybersecurity strategy's execution progress and any significant cybersecurity incidents are rigorously monitored.


text: Procedures for Information Security Risk Management and Information Security Risk Management Methodology based on the ISO 27005 Information security, cybersecurity and privacy protection standard and Control Objectives for Information and Related Technology ("COBIT"), which establishes criteria to identify, analyze, evaluate, treat and accept risks to the Company's technology infrastructure, including cybersecurity risks.


text: Our Risk Management Methodology is applied year-round and covers all of the Company's IT departments and processes. The results are used to generate and update risk and control matrices.


text: Cybersecurity risks are documented on the Information Security risks and controls matrices. Key risks and their treatment are tracked via these matrices as part of the Information Security processes, which include Vulnerability Management, Patch Management on Information Technology devices, Hardening, Information Security Incident Response, Information Security Culture Development and Cyber Threat Intelligence.


text: The IT risks and controls matrices are reviewed, authorized, and released annually by the Technology and Information Security Director. The matrices are then submitted to SCC's Internal Audit department to review and evaluate controls, in terms of design, implementation, and operational effectiveness.


text: Information Security Incident Management Procedure based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework We utilize the Cybersecurity Framework of the NIST to outline the activities and authorize personnel to handle information security and cybersecurity incident responses within the Company. This procedure outlines the phases of the incident response process, including detection and analysis; containment and intelligence development; eradication and remediation; recovery; and post-incident activities. Assessments include the qualitative and quantitative factors that are essential for determining materiality on information security and cybersecurity incidents.


text: In instances where a cybersecurity incident is classified and declared as material, our process is designed to meticulously document in a comprehensive report, all critical details such as the date and time of identification of the incident, a concise description of the incident's nature and scope, the impact of the incident on the Company's operations, and its current status (remediated or is undergoing remediation), in order to be clearly informed by the Company.


text: Information security and cybersecurity incidents undergo thorough review and assessment by the Information Security Subdirector, in collaboration with cybersecurity specialists and experts. Those incidents classified as material are reported to the Technology and Information Security Director, relevant Business Directors, and the Board's Audit Committee, with additional review by AMC's Productivity and Risk Committees.. Simultaneously, these processes allow cybersecurity incidents classified as "material" to be promptly disclosed to the SEC in a Form 8-K report within 4 business days of the Company's determination that such incident is in fact a "material" incident.


text: Oversight of Third-Party Service Providers Security Assessment Process for IT Service Providers Our Security Assessment Process for IT Service Providers is based on the ISO 27001 Information security, cybersecurity, and privacy protection standard. This standard's guidelines ensure that service providers design and implement procedures and notification mechanisms for incident response management within their technological infrastructure. All contracts with IT service providers must stipulate the service levels required by the Company.


text: Regular meetings are conducted with IT service providers to assess compliance with contracted services, which includes a report on detected information security and cybersecurity incidents, activities for their remediation, and findings and insights from previous reviews and improvements.


text: Engagement with External Experts The Company engages top-tier external cyber security firms as needed and leverage their expertise. This is part of our ongoing effort to evaluate and enhance our cybersecurity program. The information security strategy includes assessments conducted by third parties and the engagement of specialized services for specific tasks, including:


text: Internal and External Penetration Testing of SCC's Technology Infrastructure: This service is contracted at least annually to identify and remediate vulnerabilities that may exist at the infrastructure and critical operation systems levels.


text: Cybersecurity Organizational Maturity Assessment: The objective of this service is to understand the level of risk and maturity of the Company's cybersecurity controls (Cybersecurity Assessment). The results of Cybersecurity Assessments are used to design and implement work plans.


text: Disclosure of Management's Responsibilities Technology and Information Security Director and Information Security Subdirector Our management possesses significant expertise in the assessment and management of cybersecurity risks. TISD, and the Information Security Subdirector ("ISD"), has extensive experience in the areas of information technology, information security risk management, and cybersecurity. Specific to cybersecurity, the TISD and the ISD have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions that should be taken to mitigate such risks.


text: The TISD, under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The current TISD has more than 25 years of IT experience and has spent 15+ years overseeing cybersecurity strategy, implementation, and operation. Additionally, he holds a Master's degree in IT Management and a Master's Degree in Business Administration.


text: The ISD, under the direction of the TISD, is responsible for overseeing the organization's cybersecurity and promoting a security-centric culture throughout our operations. The ISD is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. Additionally, the ISD oversees the cyber risk management function, which identifies cybersecurity threats and assesses cybersecurity risks. Our ISD has more than 12 years of experience in the cybersecurity field and holds a Computer Engineering degree.


text: Risk Committee and Productivity Committee The Company's holding company, AMC, has the following Committees, that convene several times a year: AMC Productivity Committee


text: AMC Risks Committee These committees provide support to the Company's Board of Directors with respect to information security and cybersecurity matters. In particular, the Risk Committee provides oversight of the Company's risk management, cybersecurity, and operational compliance activities, as well as a means of bringing risk issues to the attention of management.


text: Disclosure of the Board's Roles and Responsibilities The Board of Directors is responsible for global oversight of our strategic and operational risks. The Audit Committee assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports its findings to the Board of Directors.


text: The Audit Committee The Audit Committee is responsible for overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, our information security strategy is periodically presented to the Audit Committee, which reports to the full Board of Directors. Regular meetings are held to report to the Audit Committee, which include a risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Risk Committee.


text: The Internal Audit Department The Internal Audit department of SCC operates in accordance to an Annual Plan that has been approved by the SCC Audit Committee. This plan encompasses the design and execution of system audits, including testing of cybersecurity controls and protocols. Recommendations from both Internal and External experts are thoroughly reviewed and evaluated and may be implemented if findings so merit.


text: Cybersecurity Incident Impact While we identified no cybersecurity incidents, we have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. For additional discussions of risks from cybersecurity threats we face, see Item 1A "Risk Factors". There were no material cybersecurity incidents in 2023.


text: We manage risks from cybersecurity threats through our overall companywide risk management process, which is overseen by our Board of Directors and specific Board Committees. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers and violations of data privacy or security laws.


text: Our Director of Information Security has twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications. Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling and/or processing our employee, business or customer data.


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations or financial condition.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not experienced any material cybersecurity incidents and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our Leadership Team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program, using the NIST framework, as well as penetration testing.


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.


text: The Company maintains a cyber security risk management program designed to prevent, detect and respond to information security threats. The program is designed to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as the banking-specific framework from the FFIEC's Cybersecurity Assessment Tool (CAT). The Company's program is led by our Chief Technology Officer ("CTO") and chief information security officer ("CISO"), whose teams are responsible for leading short and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. The CTO chairs the Bank's Technology, Operations, and Compliance ("TOC") Committee, which has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. TOC meets at least quarterly to assess, among other things, cyber threats or risks to the Company and drive awareness and alignment across the Company for effective cybersecurity risk management and reporting.

companyName: CROSSFIRST BANKSHARES, INC.


text: The Risk Committee of the Board of Directors (the "Risk Committee") is responsible for reviewing the Company's information security programs, including oversight of cybersecurity risks and threats. The Risk Committee receives quarterly reports from our CISO and CTO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. The Company's cyber security program and technology program are periodically audited by internal audit or independent third-party audit firms, and the results of these audits are reported to the Risk Committee, as well as the Audit Committee of the Board of Directors.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity, and incident response training for all employees. This training is also supplemented with periodic phishing tests.


text: We have a detailed incident response plan in place in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics. We use a third-party Security Operations Center to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents, and our CISO and CTO actively engage with key vendors, industry participants, the U.S. Department of Homeland Security, and intelligence and law enforcement communities. The company also maintains a vendor relationship with a cyber security firm that supports the Bank to review and mitigate any potential cyber incidents. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.


text: As of the date of this report, cybersecurity threats have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors for information on the risks that cybersecurity threats pose to the Company.


text: Risk Management and Strategy Reliance has implemented processes for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into the Company's overall enterprise risk management systems and processes. The Company's cybersecurity risk program is largely based on the U.S. National Institute for Standards and Technology ("NIST") cybersecurity framework and other applicable industry frameworks. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and containment. The Company has also engaged third parties in connection with the assessment and advancement of its cybersecurity risk management processes. We undertake regular vulnerability scanning, periodic penetration testing and maturity assessments with the support of third parties; vulnerabilities are subsequently addressed based on risk/benefit analyses.

companyName: RELIANCE, INC.

ticker: RS


text: To support our preparedness, we have constituted a Cybersecurity Review Committee ("CRC") and adopted a written cybersecurity incident response plan ("CIRP"). In the event of a cybersecurity incident, our CRC refers to our CIRP and existing management internal controls processes. Pursuant to these prescribed processes, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon reporting obligations, escalating information about the incident to senior management and potentially representatives from the Board, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises to test our incident response procedures, identify cybersecurity gaps and vulnerabilities and improvement opportunities and exercise team preparedness.


text: Reliance mandates regular cybersecurity training for employees and applicable contractors and considers this a critical step in safeguarding the Company's data and assets. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The course includes enhancements to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and also includes interactive modules covering various cyberattack methodologies, including insider attacks, phishing and other email attacks, malware attacks, data protection, data handling, password protections, cloud and internet security and cybersecurity fundamentals for mobile devices. We take a risk-based approach with respect to our use and oversight of third-party service providers, using a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors, and negotiating for cybersecurity-related terms in vendor agreements as appropriate. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.


text: Cybersecurity Risks Like other complex corporations, Reliance is the target of cyber-attacks from time to time. However, since January 1, 2021 (the first date covered by the financial statements presented in this Form 10-K) we have not experienced any cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, please see the risk factor set forth under the caption Item 1A. "Risk Factors" the Risk Factor captioned " We rely on information management systems and any damage, interruption or compromise of our information technology management systems, networks or data could disrupt and harm our business."


text: Roles and Responsibilities Cybersecurity is an important element of our risk management processes and an area of particular focus for Reliance's Board of Directors and management. The Company's Sr. Director, Information Security ("ISD") serves as single point of communication and coordination for protecting the Company and its digital information. The ISD performs an initial assessment of each reported cyber incident and escalates all non-trivial cybersecurity incidents and risks to the CRC. The CRC is primarily responsible for assessing and managing material risks from cybersecurity threats and is comprised of a cross-functional team including the ISD, the Chief Information Officer ("CIO") as well as senior representatives from the Company's risk management, finance and legal functions. The ISD has 17 years of cybersecurity experience, including 6 years with Reliance. The ISD maintains industry recognized credentials relevant to his role.


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the enterprise risk management processes and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the full Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management processes.


text: The full Board has designated the Audit Committee to be responsible for oversight of cybersecurity risk. The Audit Committee receives regular reports from the CIO and the ISD that may discuss topics such as prior assessments, cybersecurity trends, prior cybersecurity events, and planned enhancements. In addition, the Audit Committee also receives regular periodic reports regarding information technology general controls in connection with its oversight of internal control over financial reporting. The Chair of the Audit Committee regularly briefs the full Board on these matters.


text: We maintain an information security program as part of our enterprise-wide risk management system. Our information security program is managed by our Group Vice President, whose portfolio includes top level oversight of information technology, information security and IT risk management. The Group Vice president is responsible, along with his team, for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. Our Group Vice President has served in that role since 2012 and has been in cybersecurity related roles for 25 years. Our Group Vice President and IT Director provide periodic updates to our Board of Directors, Audit Committee, and other senior management members. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: Our program is regularly evaluated by internal and external experts with the results of those reviews reported to the Board of Directors, Audit Committee, and senior management. We also collaborate with thought leaders in cybersecurity including with key vendors, business partners, cybersecurity and data breach response counsel, and industry participants as part of our continuing efforts to evaluate and improve the effectiveness of our information security policies and procedures. This collaboration allows us to rapidly adopt industry best practices developed through firsthand experience mitigating cyber incidents.


text: When reviewing potential threats or cybersecurity incidents, our Board of Directors has delegated the authority to the Audit Committee to setup crisis incident management teams comprised of senior management and appropriate specialists. These crisis incident management teams report on an as needed basis to the Audit Committee and full Board of Directors to keep them informed and seek direction where necessary.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including " We rely on information technology in our operations, and any material failure, inadequacy, interruption, or security failure of that technology could harm our business," for additional discussion about cybersecurity-related risks.


text: Cybersecurity Risk Management We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Additionally, in the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. For example, in 2023 we engaged several third parties to assist with implementing processes regarding endpoint detection and response, logging and monitoring, multi-factor authentication, business continuity and disaster recovery, and internet proxies. Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.


text: Although we believe risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations, or financial condition, we have, from time to time, experienced threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".


text: The Vice President of Information Technology ("VP of IT") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").


text: Our governance framework includes oversight by the Audit Committee of the Board of Directors. The Audit Committee meets quarterly with the CFO regarding the cybersecurity risk management program, including as relates to critical cybersecurity risks and cybersecurity initiatives and strategies. Additionally, on an annual basis, the VP of IT reports the current state of cybersecurity risk management to the full Board of Directors. The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management.


text: The Company assesses cybersecurity risk and exposure on an ongoing basis and implements tools that are commensurate with the risks that the Company faces. In light of the Company's relatively small size and personnel, it relies heavily on reputable third-party vendors to mitigate key cybersecurity risks and exposures. While the nature of the Company's business and the data it processes inherently limit the Company's exposure to cybersecurity risk, the Company has implemented and maintains controls, policies, procedures and safeguards to maintain and protect confidential information as well as the integrity, continuous operation, redundancy and security of all information technology systems and data used in connection with the Company's business. The Company generally approaches cybersecurity threats through a comprehensive approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Farmland Partners Inc.

ticker: FPI


text: Risk Management and Strategy Consistent with overall risk management policies and practices, the Company's cybersecurity program focuses on the following areas:


text: Vigilance: The Company employs tools to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents in accordance with our internal cybersecurity policies and controls.


text: Systems Safeguards: The Company and its third party vendors deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis.


text: Third-Party Risk Management: The Company ensures that all third party vendors that process or have access to sensitive information have appropriate cybersecurity risk controls in place.


text: Training: The Company communicates regularly with employees to increase awareness around phishing and spoofing attempts and other cybersecurity schemes. Employees are encouraged to report suspicious emails or incidents to the General Counsel or the President and Chief Executive Officer.


text: Incident Response Policies: The Company has established and maintains incident response policies that address the Company's response to a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and the Board.


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives presentations on cybersecurity issues and developments as needed. The Board also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting this incident to the Board and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Mr. Fabbri, in coordination with the Board, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Board and applicable regulatory authorities when appropriate.


text: The Company has in the past experienced cyberattacks on its computer networks and, although none to date have been material, the Company expects that additional cyberattacks will occur in the future. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Senior Director of Information Technology ("IT"), internal IT, information security and legal functions, and third-party service providers (collectively, "Cybersecurity Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response strategy, incident detection and response measures, a vulnerability management policy, risk assessments, encryption of certain data, network security controls, data segregation, access controls, physical security controls, systems monitoring controls, personnel training, penetration testing, cybersecurity insurance, dedicated cybersecurity personnel, background checks for certain personnel, vendor management strategies, and asset management strategy (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence service providers, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract manufacturing organizations. We maintain a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. The strategy includes vendor risk assessments, security assessment reviews, and imposing information security contractual obligations on a vendor as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategy may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's management and its designees report to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from management and its designees concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology ("Information Systems and Data").

companyName: Y-mAbs Therapeutics, Inc.


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, Legal and Compliance Administration, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, by using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response policy and incident detection and response procedures, disaster recovery and business continuity plans and an IT contingency policy, encrypting certain data, conducting risk assessments for certain data and systems, implementing certain network security, physical and access controls, monitoring our systems, providing periodic training to employees and using tools such as penetration testing tools.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT and Legal and Compliance departments work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, our third-party IT service provider, cybersecurity consultants, outside legal counsel, software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, including hosting providers, CROs, and CMOs. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes, as appropriate, risk assessments of vendors, reviewing our vendors' information security program, reports, audits, and imposing relevant contractual obligations on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Director of IT, HR & Administration, and our Chief Financial Officer, Treasurer and Secretary (CFO).


text: Our Director of IT, HR & Administration has been responsible for IT and cybersecurity for approximately 15 years across several organizations, and is currently responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has had the overall IT and cybersecurity responsibility since inception of the Company in 2015 and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and CEO, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: As part of its oversight of the Company's overall risk management, the audit committee is periodically updated by our CFO concerning cybersecurity threats and risks and the processes the Company has implemented to address them.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management initiative is a cornerstone of our information security program, which includes a cross-functional management team with representatives from Legal, Enterprise Risk Management, Information Security, Information Technology, and Engineering. The cybersecurity risk management work is directed by the Enterprise Risk Management Team in collaboration with the Information Security Team and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program includes a cybersecurity incident response plan and playbook.

companyName: Vertex, Inc.

ticker: VERX


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management initiative is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management initiative includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a risk management team responsible for managing our cybersecurity risk assessment processes and acts as a check and balance on our information security team which is responsible for maintaining, monitoring, and updating our security controls as well as managing our response to cybersecurity incidents;


text: a cybersecurity incident response plan and playbook that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A."Risk Factors – We are exposed to cybersecurity and data privacy risks that, if realized, could expose us to legal liability, damage our reputation, and harm our business."


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our general counsel, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our general counsel, with oversight by the Vertex Executive Leadership Team, is responsible for assessing and managing our material risks from cybersecurity threats. This team of attorneys and certified risk and information security professionals, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our general counsel's experience includes over twenty years of legal, information security, compliance, and risk experience and positions of leadership in global organizations supervising information security, compliance, and risk professionals and programs.


text: Risk Management and Strategy. We have designed and implemented processes to assess, identify, manage, detect, and respond to material cybersecurity risks and threats to our IT systems, including the prevention, detection, mitigation, and remediation of cybersecurity incidents in order to protect the confidentiality, integrity, and availability of our IT systems and the information residing on those systems. These processes are part of our overall risk management process and are embedded in our operating policies, procedures, and controls.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: To protect our IT systems and information from cybersecurity risks, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools. We also utilize a third-party security operations center connected to a networks operation center to identify, investigate, and resolve any cybersecurity threats and incidents.


text: We regularly assess technological risks to our IT systems and information and monitor our IT systems for potential vulnerabilities and risks. We frequently conduct mandatory cybersecurity and IT systems awareness training for all employees with access to our systems. We also conduct regular reviews and tests of our IT cybersecurity processes, including reviews, assessments, and exercises.


text: We aim to incorporate responsible practices throughout our cybersecurity risk management processes. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engage independent third-party specialists to review our cybersecurity environment, including formal reviews and assessments, and we request specific, actionable recommendations for improvement.


text: While we have not, as of the date of this Report on Form 10-K, experienced a cybersecurity threat or incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our mining and manufacturing operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes through regular reviews and assessments, to provide incident response assistance and expertise, and to provide a level of financial protection in the event of cybersecurity incident related costs and losses. See "Risk Factors - We may be adversely affected by any disruption in, or failure of, our information technology systems, including due to cybersecurity risks and incidents."


text: Governance. Our Manager of Information Technology ("MIT") is responsible for our IT cybersecurity policies, procedures, and controls and reports to our Chief Financial Officer ("CFO"). Our MIT has a Bachelor of Business Administration degree in management information systems and has over 20 years of relevant experience in the IT field. Team members also include third-party service providers who have relevant education and experience in cybersecurity.


text: Our CFO is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our CFO and MIT regularly report to and review our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.

companyName: Quanterix Corp

ticker: QTRX


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate.


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation. "


text: Risk Management and Strategy. The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to security incidents when they occur, while also maintaining controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: The Company relies on a comprehensive Enterprise Risk Management ("ERM") program, which includes cybersecurity as an important component. Our cybersecurity program is focused on the following key areas:


text: Risk Assessment. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting appropriate security controls to address such risks.


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the systems involved, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), and vulnerability and patch management.


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. These testing efforts conducted by our in-house security teams and by third-party security firms include audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Individual controls are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Independent Assessments. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: Third-Party Risks. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.


text: Education and Awareness. The Company provides regular, mandatory training for personnel on cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. The training includes phishing and smishing exercises.


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks, and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Governance. The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's Chief Security Officer ("CSO"), Chief Information Officer ("CIO"), the Chief Privacy and Regulatory Compliance Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, among other relevant information.


text: The Board and its Security & Technology Committee also receive prompt and timely information regarding any cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's CSO, CIO, and Chief Legal & Risk Officer, and other members of management.


text: The CSO, in coordination with other members of TTEC executive leadership team, works collaboratively across the Company to implement a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CISO/CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.


text: Our CIO holds an undergraduate degree in Computer and Electrical Engineering and has served in various roles in information technology for over 25 years, including serving as either the chief technology officer or chief information officer for two large public companies and a technology start-up.


text: The Company has previously experienced significant cybersecurity incidents. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: an internal cybersecurity team that is responsible for establishing security standards and conducting regular assessments of our information systems, controls, vulnerabilities and potential improvements; continuous monitoring tools to detect and respond to cybersecurity threats in real-time;


text: performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures;


text: third-party cybersecurity consultants, who conduct periodic penetration testing and vulnerability assessments to identify potential weaknesses in our systems and processes; and periodic cybersecurity training for our workforce.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our program and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. These officers are both experienced Certified Information Systems Security Professionals (CISSPs) who have more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.


text: In addition, our board of directors, as a whole and through its Risk Oversight Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: EchoStar CORP

ticker: SATS


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, DISH Network experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.


text: After investigation and discussions with certain third parties, we determined that our customer databases were not accessed, however, we confirmed that certain employee-related records as well as a limited number of other records containing certain personal information were among the data extracted. We took steps to protect the affected records, received confirmation that the extracted data was deleted and notified individuals whose data was extracted.


text: The DISH TV, SLING TV and Retail Wireless services, along with our wireless and data networks remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. Our cybersecurity team works in conjunction with the management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.

companyName: IRADIMED CORP

ticker: IRMD


text: The IRadimed board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk and assists the Company's board of directors in fulfilling its oversight responsibilities regarding the Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.


text: Risk Management and Strategy We recognize the importance of maintaining the trust and confidence of our investors, patients, business partners, and employees. Our board of directors are actively involved in the oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the international organization for standardization. In general, we seek to address cybersecurity risks through a comprehensive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Collaborative Approach We have implemented a comprehensive cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning We have established and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness We provide regular mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools and education to address cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices.


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.


text: On an annual basis, the board of directors discuss our approach to cybersecurity risk management with management which includes our Chief Information Officer ("CIO"). Our CIO has overall operational responsibility for our cybersecurity risk management. To facilitate the success of our cybersecurity risk management program, we have an Infrastructure, Operations & Security Team ("IOS Team") that is tasked with the responsibility to design, implement, and manage systems, processes, and policies to defend against cybersecurity threats and to respond to cybersecurity incidents. Working collaboratively across our Company, the IOS Team implements and maintains a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management system. We have a cross-departmental approach to identifying, assessing, and managing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and its Risk Committee and Audit Committee (respectively, the "Risk Committee" and the "Audit Committee"), as well as senior management in, among other areas, the information security, information technology, operations, and risk management (including enterprise and operational risk) areas, devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and to identify and respond to cybersecurity threats and incidents in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, identification, and remediation. Our information technology and information security areas review enterprise risk management-level cybersecurity risks continually, and key cybersecurity risks are incorporated into the Company's Enterprise Risk Management Framework that supports its Risk Appetite Statement. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. On an annual basis, the Board approves the Company's Information Security Policy and Program which provides a layered approach to cybersecurity, and includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information in accordance with applicable law.

companyName: SouthState Bank Corp

ticker: SSB