text: We face numerous cybersecurity risks in connection with our business. Such risks can impact our systems, results of operations and financial condition. We have, from time to time, experienced threats to, and breaches of, our data and systems, including malware, ransomware and computer viruses. Our customers, suppliers, subcontractors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. As of the date of this Form 10-K, we have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition. For more information about the cybersecurity risks we face and the potential impacts on our Company due to a cybersecurity incident, please refer to Item 1A - Risk Factors - "Risks Related to Intellectual Property, Cybersecurity, Information Technology and Data Privacy".


text: The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, our CIO and our CISO regularly brief the Audit Committee on cybersecurity matters. In its oversight role, the Audit Committee receives reports on cybersecurity, including internal and external cybersecurity audits, on at least a quarterly basis. We have procedures led by our CISO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and determine the appropriate or required external notifications. Based on an incident's nature and severity, the Audit Committee would be informed of an incident by our executive team.

companyName: Qorvo, Inc.

ticker: QRVO

secItem: Item 1C


text: Our CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO, who reports to our Chief Financial Officer, has over 30 years of experience in various IT and cybersecurity leadership roles throughout the industry. Our CISO has over 24 years of experience in cybersecurity, encompassing leadership roles in cybersecurity architecture, risk and compliance, incident response, cybersecurity operations, and identity management. The CISO works with a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. This team manages and works to enhance the IT security structure with the goal of preventing significant cybersecurity incidents and increasing the resilience of our systems to minimize the business impact should an incident occur. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals on the information security team.


text: Risk Management and Strategy To help address cybersecurity threats, we have developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader ERM program. We are committed to a risk-centric, layered information security approach to secure our data, systems, and services. We prioritize our data security initiatives and processes based on our assessment of known and anticipated threats to our data security. Utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, we strive for continuous improvement and utilize a metrics-based approach to identify and mitigate data security risks that could potentially impact our business operations or clients.

companyName: H&R BLOCK INC

ticker: HRB


text: We maintain multiple levels of protection to mitigate data security risks, and we regularly test our systems to discover and address potential vulnerabilities, including without limitation: • using a multi-layered, zero-trust principled approach to secure systems; • systematic monitoring of our sites and services to detect and respond to unauthorized activity; and • regular security audits and vulnerability assessments conducted by our dedicated internal information security team, our internal auditors, and by external third parties.


text: In addition, we engage in a broad range of activities to secure and protect the data that we obtain through our business operations including, but not limited to: • continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access; • security and business controls to appropriately limit access to and use of personal information, including adaptive and multifactor authentication; • comprehensive data protections, including encryption, to facilitate the secure storage, use, and transmission of sensitive data; • annual privacy/data security training to all employees and contractors and regular awareness and testing activities year-round regarding social engineering threats, such as phishing, for employees; • background checks on our employees, as permitted; • due diligence requirements and controls for third parties (e.g., service providers) with access to sensitive data throughout the lifecycle of the relationship; and • a dedicated global information security team that partners with all technology groups to monitor, prioritize, and remediate risks to the enterprise.


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Vice President, Legal and Corporate Secretary, oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Legal and Administrative Officer (CLAO) and the CISO. The Board of Directors is also updated by the CLAO and CISO on a periodic basis. Our CLAO, who reports directly to the President and CEO, has over 30 years of leadership experience across multiple industries in roles responsible for overseeing and managing risk. Our CISO, who reports directly to the CLAO, has extensive cybersecurity knowledge and skills gained from over 30 years of experience in consulting and technology roles, with more than 18 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by us to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also periodically engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats, and Incidents We have been, and continue to be, the subject of cybersecurity threats, and we describe how risks from these threats, if realized, are reasonably likely to materially affect us. See further discussion of these items in our Item 1A. Risk Factors of this Form 10-K. As of the date of this report, we have not identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations, or financial condition, in the future.


text: Our risk management program is designed to identify, assess and mitigate risks across our company. When considering financial, operational, regulatory, reputational and legal risk, our program is well matched for our size and complexity. Our Chief Technology Officer, in conjunction with the Chief Operating Officer, is currently responsible for managing our information security program. Given the increasing risk involving cybersecurity and the Bank's evolving needs and reliance on technology, our strategy involves the addition of a Chief Information Security Officer. The Chief Information Security Officer will be primarily responsible for the cybersecurity component of our risk program. These responsibilities include performing and maintaining a cyber risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, access levels, third party risk and vendor management and business continuity planning. This key role will be developed as we expand our overall risk management program.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: Our objectives for managing cybersecurity risk is to greatly minimize the impacts of external threats. This includes, but is not limited to, efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed to comply with industry standards, such as the National Institute of Technology Cybersecurity Framework. We successfully leverage several associations, industry groups, audits and enhanced monitoring to promote the effectiveness of our program. Our Chief Technology Officer, who reports to our Chief Operating Officer, collaborates regularly with peer banks and other industry groups to identify and implement best practices. Our program is regularly reviewed in an effort to address emerging trends and threats.


text: We maintain multiple controls in an effort to manage cybersecurity threats. We employ various preventative and detective controls to monitor, block and prevent suspicious activity including those that provide real-time alerts and response. We have systems designed to mitigate cyber risk, which includes ongoing training for employees, preparedness and tabletop exercises, and recovery testing. We maintain a robust vendor management program that identifies, assesses and documents risk associated with external service providers. We proactively monitor email servers for malicious activity and limit remote work only to qualified positions. We leverage internal and external auditors to review processes, systems and controls related to our information security program to ensure they are operating effectively. Management proactively responds to all recommendations designed to strengthen or improve our operating environment.


text: We maintain a detailed Incident Response Plan which outlines the steps we would implement in the event of an actual or potential cybersecurity event. The Incident Response Plan includes timely notification of an escalation to the appropriate levels of management and Board of Directors. The Incident Response Plan is reviewed and updated at least annually and mandates coordination and collaboration across all levels of management and all areas of the Bank.


text: The Board of Directors reviews components of the information security program on annual basis including policies, procedures, risk assessments, table top testing results, attestations, budgets and strategies. These components are presented by Executive Management as part of the regular board meeting schedule and strategic planning process.


text: Risk management and strategy Via Renewables, Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Managing Material Risks & Integrated Overall Risk Management Via Renewables, Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integrated part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Via Renewables, Inc. engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Via Renewables, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established a robust oversight mechanism to ensure effective governance in managing risks associated by cybersecurity threats because we recognize the significant of these threats to our operations integrity and stakeholder confidence.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Chief Operating Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Chief Operating Officer provides comprehensive briefings to the Audit Committee on a regulatory basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and Chief Operating Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Via Renewables, Inc. The Audit Committee conducts an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 26 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to the Board of Directors The Director of Infrastructure, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Operating Officer (COO) of all aspects related to cybersecurity risks and incidents. The CFO and COO regularly inform the Chief Executive Officer (CEO) of such risk and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Via Renewables, Inc. Furthermore, significant cybersecurity mattes, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 27 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities.


text: In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: The Company has multi-layer processes to assess, identify and manage material risks from cybersecurity threats. These processes are integrated into the Company's enterprise risk management as part of its overall risk management strategy.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The VP, Chief Privacy Officer, who has 30 years of IT and IT security experience, 20 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.


text: The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following:


text: The VP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.


text: The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements.


text: The Company employs an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.


text: The Company additionally performs annual tabletop exercises with the information technology team pertaining to infrastructure and cyber security related events, to test the Company's incident response and business continuity plans in the event of a cybersecurity incident.


text: Bi-annually the Company engages a third party to conduct an audit of the Company's cybersecurity systems and processes to test their adequacy and efficacy. The results are shared with senior leadership and the Audit Committee of the Board, and incorporated into strategic security plans. The Company maintains cybersecurity insurance, which is assessed annually for the appropriateness of coverage levels and emerging trends.


text: The Company also has in place an Incident Response Plan that enables it to quickly categorize, respond, and escalate to senior leadership and the Audit Committee of the Board, real or potential cybersecurity incidents in a manner designed to mitigate overall business impact.


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the VP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the VP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled " Our inability or failure to execute our business continuity and response plan following a major disaster such as a natural disaster, terrorism, social unrest or a cybersecurity incident affecting our corporate facilities could materially adversely affect our business" in "Item 1A, Risk Factors" in this report for additional information about risks related to cybersecurity matters.


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Senior Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The SVP, Chief Privacy Officer, who has over 30 years of IT and IT security experience, 21 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.


text: The SVP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.


text: The Company employs an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing throughout the year to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the SVP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the SVP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. In the last three years, the Company has not experienced any material cybersecurity incidents and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "Item 1A, Risk Factors— Risks Related to Information Technology and Data Security" in this Annual Report for additional information about risks related to cybersecurity matters.


text: Avanos has implemented a comprehensive cybersecurity program to identify, assess and manage material risks from cybersecurity threats. In addition, we have instituted executive management and board oversight of the risks arising from cybersecurity threats. Cybersecurity Risk Management and Strategy.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Vice President, Chief Information Officer (the "CIO").


text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (H-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.


text: Our cybersecurity protection strategy incorporates a Vulnerability Management process and solution to assist in the identification of potential vulnerabilities in our systems. If vulnerabilities are identified, we utilize a follow-on process to remediate such vulnerabilities. A third-party software-as-a-service (SaaS) provider conducts code scanning and vulnerability assessments of our external-facing websites. Furthermore, multiple cybersecurity controls exist on and around our servers and end-user systems to prevent unauthorized system and data access and data leakage. Additionally, third-party vendors conduct yearly penetration tests to search for risks to our systems utilizing techniques commonly used by bad actors.


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover the network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our CIO and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.


text: Controls assessments are completed annually with respect to any remediation activities that have been identified and completed as part of the cybersecurity program. Avanos engages third-party vendors to conduct assessments and deliver their recommendations for improvement annually. Where appropriate, third-party vendors also assist with remediation projects.


text: We have a third-party risk management program. Prior to engaging third-party service providers, we conduct a cybersecurity risk assessment and utilize a third-party exchange service to gather security posture ratings across all of the third party's IT security, compliance and data privacy domains.


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to affect us, including our business strategy, results of operation or financial condition.


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2023, our Audit Committee met four times.


text: Our CIO (who has 14 years of cybersecurity experience) and our Associate Director of Global Cybersecurity (who has 25 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Director of Global IT Security and Compliance.


text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (Health-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover our network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our Vice President, Chief Information Officer (the "CIO") and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2024, our Audit Committee met four times.


text: Our CIO (who has 15 years of cybersecurity experience), our Director of Global IT Security and Compliance (who has 11 years of cybersecurity experience and 25 years in IT), and our Associate Director of Global Cyberseurity (who has 26 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. We recognize the significance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity, and availability of our data.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Cybersecurity Risk Management and Strategy We have designed our cybersecurity risk management program and strategy to protect the confidentiality, integrity, and availability of our critical information technology systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, through which we identify, assess, prioritize, and mitigate risks across the Company to support the achievement of our strategic objectives.


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Information Officer ("CIO") leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.


text: We utilize ISO 27001 to identify, assess and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.


text: Third Party Engagements for Risk Management We engage a range of external experts, including cybersecurity consultants and auditors to support, evaluate and test our cybersecurity risk management systems. We engage a managed security service provider ("MSSP") that provides continuous threat intelligence by monitoring our network and connected devices to detect attacks and indicators of potential attacks.


text: Our collaboration with other third parties includes regular audits of our ISO 27001 compliance, penetration testing, threat assessments, and consultation on security enhancements. These partnerships provide expert knowledge and insights which are designed to ensure our cybersecurity strategies and processes are appropriate.


text: The Board's Role The Board is responsible for overseeing overall risk management for the Company, including annual or more frequent review and approval of the Enterprise Risk Management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated certain responsibilities for oversight of the Company's cybersecurity and information security framework, data protection, cybersecurity, and risk management to the Audit Committee of the Board. Our Board recognizes that cybersecurity protection is vital to maintaining our operations, and the trust of our business and supply chain partners, and of our Share Owners.


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, two regular Board meetings each year and each Audit Committee meeting include additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.


text: Management's Role Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CIO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: The Company's Chief Information Officer has formal education in information technology and extensive experience over 20 years working in and leading information systems and technology functions. Our Chief Information Officer receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CIO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CIO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with us in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CIO and CIRT about the same.


text: Risks from Cybersecurity Threats As part of our overall risk mitigation strategy, we maintain insurance coverage for certain aspects of cybersecurity risks; however, such insurance may not be sufficient either in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks, and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item 1A - Risk Factors - "Our business may be harmed due to failure to successfully implement information technology solutions or a lack of reasonable safeguards to maintain data security, including adherence to data privacy laws and physical security measures."


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Legal and Administrative Officer leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.


text: We utilize ISO 27001 to identify, assess, and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, at two meetings each year, management includes additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.


text: Management's Role Our cybersecurity risk management program is led by our Chief Legal and Administrative Officer (CL&AO), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CL&AO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: The Company's CL&AO has formal education in information technology and computer science, and extensive experience over 30 years leading information systems and network security functions, centered on technology-intensive telecommunication companies and electronics manufacturers. Our CL&AO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CL&AO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CL&AO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts, and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with our KESC, CIRT, and senior members of our information technology department in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CL&AO and CIRT about the same.


text: Our Chief Financial Officer and our Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Global IT Director has 20 years of experience in the design, implementation, and support of information technology infrastructures.

companyName: Pangaea Logistics Solutions Ltd.

ticker: PANL


text: We utilize industry standard software packages such as RSA and Cisco Firepower to secure our networks. We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, we perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity training for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. F or additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.


text: Risk Management Strategy for Handling Sensitive Data is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI


text: Over the ordinary course of our business, Arvana and its third-party service providers, such as charter booking services, collect, maintain, and transmit sensitive data including proprietary or confidential business information (such as operational data and personal information). The secure maintenance of this information is critical to our business and reputation.


text: our efforts to implement robust security measures, in reliance on administrative, technical, and physical safeguards, our risk management strategies, and practices for protecting sensitive data are subject to certain limitations. A variety of factors give rise to these limitations including the evolving nature of cyber threats, resource constraints, and the inherent risks associated with the technologies we and third-party service providers employ. Arvana relies on third parties, including cloud vendors and consultants, for various business functions.


text: Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the operation of our business. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk.


text: current risk management strategy may not fully account for or mitigate the risks posed by emerging technologies or the potential impact of these limitations on our business. Financial liabilities, damage to our reputation, and erosion of customer trust could negatively affect our business operations and financial condition.


text: have adopted a cybersecurity governance structure to identify, assess, and manage material risks from cybersecurity threats that include a framework to respond to and assess internal and external threats to the security, confidentiality, and integrity of Arvana's data and information systems. Under which framework management is responsible for assessing and managing material risks that arise from cybersecurity threats. We have not engaged third-party qualified contractors or claim any management expertise from which to draw in the event of cybersecurity threats.


text: identified by management, cybersecurity threats are to be immediately reported to Arvana's Audit Committee. The Audit Committee has primary responsibility for oversight of cybersecurity threats once a cybersecurity threat has been reported to it by management. Matters to be considered by the Audit Committee include management risks relating to data privacy, technology, and information security.


text: The Audit Committee must also consider Arvana's cyber security measures and the back-up of information systems, along with what steps Arvana has taken to monitor and control cybersecurity exposure. Further, the Audit Committee is tasked with the responsibility for conferring with management and Arvana's auditors as to the adequacy and effectiveness of information safeguards, cybersecurity policies, and internal controls that impact information security. The Audit Committee will be briefed on any material cybersecurity incidents that might adversely affect our business at least once each year, such brief will include topics such as risk assessment, risk management, control decisions, service provider arrangements, security incidents, responses with recommendations for changes or updates to policies and procedures.


text: Arvana has not experienced cybersecurity incidents in the past, it cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors.


text: cybersecurity incident could materially affect our business, results of operations, financial condition, and reputation, in addition to potentially subjecting us to government investigations, litigation, fines or damages.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Weave Communications, Inc.

ticker: WEAV


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our Audit Committee and Board of Directors.


text: Our business strategy, results of operations and financial condition have not to date been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see the section titled "Risk Factors" set forth in Part I, Item 1A of this Annual Report on Form 10-K.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security, who has over twenty years of cybersecurity experience across multiple industries. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our A udit Committee and Board of Directors.


text: We rely on information systems to communicate, control and manage our operations, prepare our financial and reporting information, analyze and store data and communicate internally and with third parties, including our service providers and customers. Our cybersecurity program focuses on ensuring the protection of our information systems, computer networks, infrastructure, and industrial control systems.

companyName: California Resources Corp

ticker: CRC


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Information Officer on cybersecurity risks at its regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee.


text: We take a risk-based approach to assess, identify, and manage cybersecurity risks, including evaluating the likelihood of a cybersecurity incident as well as the impact it would have on our business, reputation, assets, health and safety of individuals and the environment. Our controls are based on the NIST Cybersecurity Framework (CSF). The effectiveness of our controls are evaluated periodically to determine residual risk levels and guide ongoing program improvement and cybersecurity project work. Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements.


text: In accordance with our cybersecurity incident response plan, the severity of cybersecurity incidents is classified based on the degree of adverse impact on our business, scale of penetration, risk of propagation, significance of impact, impact on protected information, and our monitoring capability. Incident response is overseen by a cybersecurity incident response team steering committee comprised of members of management with the responsibility to inform senior management and/or the Audit Committee based on incident severity classification.


text: Our Chief Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team steering committee. Our Chief Information Officer has over 34 years of experience in information technology and cybersecurity, including leadership roles responsible for cybersecurity and data privacy for large publicly-traded and global companies. He graduated from Bellevue University with an M.S. in Computer Information Systems and an MBA.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We rely on information systems, computer networks and digital technologies to operate our business, including managing our operations, protecting sensitive data, communicating internally and externally, and preparing financial and operational information. Our cybersecurity program is designed to protect these critical systems and data while supporting business operations and growth objectives.


text: We maintain a comprehensive, risk-based approach to assess, identify and manage material risks from cybersecurity threats. Our controls are based on the NIST Cybersecurity Framework (CSF). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework and include: (i) regular assessment and monitoring of internal and external cybersecurity threats, (ii) evaluation of potential impacts on business operations, financial performance and stakeholder interests, (iii) periodic evaluation of control effectiveness to determine residual risk levels and guide program improvements, and (iv) integration of cybersecurity considerations into business strategy and technology decisions.


text: Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements. We regularly evaluate and adjust these processes based on changes in the threat landscape and business environment.


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Digital Information Officer on cybersecurity risks at regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee. We maintain a dedicated cybersecurity team responsible for program implementation and operational security activities.


text: Our Chief Digital Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team. Our Chief Digital Information Officer has over 27 years of experience in information technology, including leadership roles responsible for cybersecurity and data privacy. He graduated from California State University, Bakersfield with a Bachelor of Science degree in Computer Science.


text: Cybersecurity Risk Management and Strategy We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. As such, we have implemented an information security program, which includes cybersecurity risk management measures intended to prevent, detect, and respond to malicious cyber activities and other security incidents that could adversely affect the confidentiality, integrity, or availability of our, or our customers' information or information systems.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Our information security program is designed based on the National Institute of Standards and Technology ("NIST") 800-53 framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST framework as a guide in designing and implementing our information security program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."


text: Our information security program is principally managed by our information security team, which is led by our Information Security Officer. Our Information Security Officer reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Information Security Officer. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.


text: Our information security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.


text: Key elements of our information security program include but are not limited to the following: (i) risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including oversight of management's implementation of our information security program. The Audit Committee receives quarterly reports from our Chief Technology Officer on our information security program, including any material cybersecurity risks. Additionally, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our information security program is principally managed by our information security team, which is led by our Senior Director, Information Services and Security. Our Senior Director of Information Services and Security reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Senior Director of Information Services and Security. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations.


text: Our information security team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: GoDaddy maintains an enterprise-wide cybersecurity program designed to manage risks to the company's information systems from cybersecurity threats and cybersecurity incidents.

companyName: GoDaddy Inc.

ticker: GDDY


text: Board and Audit and Finance Committee Governance Our board of directors (the Board) is committed to managing data privacy and cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee is responsible for overseeing and reviewing with management GoDaddy's cybersecurity matters. The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding the state of the company's cybersecurity risk management program, the company's current material cybersecurity risks, and general cybersecurity-related risks. The Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. In addition, the company's CISO and Chief Technology Officer (CTO) provide the full Board with written quarterly and annual reports on the state of the company's cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.


text: Management of Cybersecurity Risk GoDaddy management is responsible for identifying, assessing, and managing the company's material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures and maintaining the company's cybersecurity programs.


text: GoDaddy's CISO has primary responsibility for overseeing the company's programs for identifying, assessing, and managing the company's cybersecurity risks. The CISO reports directly to the company's CTO and also regularly provides reports and updates to the company's CEO on significant cybersecurity-related matters relevant to the company's cybersecurity risk. The company's CISO has more than 18 years' experience in cybersecurity, networking, and related technologies. The company's CTO has more than 25 years' experience in network security and other related technologies. The company's CEO has more than 27 years' experience in ecommerce technology, engineering, and other related areas.


text: The CISO, CTO, and CEO work together to assess and manage cybersecurity-related risks. The CISO is responsible for day-to-day operations working with an enterprise-wide cybersecurity team that provides 24/7/365 support. The CISO regularly confers with the CTO and CEO on cybersecurity matters, including providing notice of cybersecurity threats and incidents, including those that have the potential to have material effects. The CISO also provides written monthly and quarterly reports on the state of the company's cybersecurity program and cybersecurity risks to the CTO, CEO, and other key executives. As noted above, the CISO and CTO also provide regular reports to the Audit Committee and the Board.


text: The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO. The company's information security department performs functions that include but are not limited to general security operations, event monitoring, incident response, vulnerability management, policy and procedure development, security compliance, product development support, product security readiness testing, third-party vendor security assessments, and penetration testing. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization and the company's privacy, legal, third-party risk management, and corporate audit services teams. The company also has developed processes to integrate cybersecurity risk management within the company's product and software development processes.


text: In addition, product teams and business unit leaders are involved in cybersecurity risk management during product development with support from our enterprise-wide security team supervised by the CISO.


text: Third-Party Consultants and Auditors GoDaddy maintains industry certifications for some of the services we provide, including certifications relating to our GoDaddy Registrar, Registry, Domains, and Commerce businesses. We use third-party auditors and consultants in connection with obtaining and maintaining our certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.


text: Third-Party Cybersecurity Risk Management We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. In particular, we host a substantial portion of our IT infrastructure and data on services maintained by Amazon Web Services. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following depending on the scope and nature of the engagement: • incorporating provisions in vendor contracts that require third parties meet certain minimum cybersecurity standards based on the nature of the product or service provided; • installing monitoring software and other tools to detect malicious software and activities in systems operated by third parties; • maintaining processes for monitoring for and applying updates and patches to third-party hardware and software to address vulnerabilities; and • performing security and data privacy assessments before engaging new vendors or acquiring new hardware and software.


text: We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. We apply similar controls to third-party providers of cybersecurity services that we apply to other IT hardware, software, and services described above. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity Threat Monitoring and Incident Response GoDaddy monitors for threats to our information systems on an ongoing basis through a combination of automated intrusion detection monitoring solutions, review of log data, and other related activities. We also require security training for all GoDaddy personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents that are not captured through our monitoring solutions. We also provide mechanisms for interested third parties, including security researchers and law enforcement to provide us notice of potential cybersecurity threats.


text: Potential and actual cybersecurity incidents primarily are handled by our internal incident response team, which is supervised by our CISO. Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts. Depending on the severity and scope of the incident, we may also engage external consultants. Security personnel and consultants retained by our service providers may also be involved in cases where our vendors experience a cybersecurity incident. In the event of a potentially material cybersecurity incident, we have defined processes for escalating the incident for determination of whether the incident is material and requires filing of a notification on Form 8-K or other notification required under applicable laws and regulations.


text: Board and Audit and Finance Committee Governance Our board of directors (the Board) manages cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding our company's cybersecurity risk management program and cybersecurity-related risks. The Audit Committee consists of Board members with diverse expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. Our CISO provides the full Board with written quarterly and annual reports on our cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.


text: Management of Cybersecurity Risk Our senior management is responsible for identifying, assessing, and managing the company's material cybersecurity risks. Our CISO oversees our programs for identifying, assessing, and managing our cybersecurity risks. Our CISO reports to our Chief Operating Officer (COO) and regularly provides updates to our CEO on significant cybersecurity-related matters. Our CISO also provides written monthly and quarterly reports on our cybersecurity program and risks to the CEO, Chief Technology Officer, and other key executives. Our CISO has more than 19 years' experience in cybersecurity, networking, and related technologies. Our CEO has more than 28 years' experience in e-commerce technology, engineering, and other related areas.


text: Our CISO works with an enterprise-wide cybersecurity team that provides 24/7/365 support. Our cybersecurity policies, procedures, and strategies primarily are implemented by our information security department. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to our technology organization and our privacy, legal, vendor risk management, and corporate audit services teams. We have also developed processes to integrate cybersecurity risk management within the company's product and software development processes. In addition, product teams and business unit leaders are involved in product-related cybersecurity risk management.


text: Third-Party Consultants and Auditors We use uses third-party auditors and consultants in connection with obtaining and maintaining industry certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.


text: Third-Party Cybersecurity Risk Management We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following: • including provisions in vendor contracts that set minimum cybersecurity requirements; • installing monitoring software to detect malicious software and activities in third party systems; • monitoring for and applying patches to third-party hardware and software to address vulnerabilities; and • performing security assessments before engaging new vendors or acquiring new hardware and software.