text: To ensure threat and vulnerability information is up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide alerting and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the National Institute of Standards and Technologies cybersecurity framework. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: AMERICAN STATES WATER CO

ticker: AWR

secItem: Item 1C


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors ("the Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss the implementation status of plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams participate in Registrant's Cybersecurity Incident Response Team ("CIRT") to be kept current on all aspects related to a cyber-attack, if a cybersecurity incident were to occur.


text: Responses to cyber-attacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyber-attack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyber-attack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law.


text: To ensure that members of Registrant's Board are informed of material cyber-attacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyber-attack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyber-attack could be significant depending on the severity of the cyber-attack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an everchanging landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which follow frameworks established by the National Institute of Standards and Technology (NIST). These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: We work to protect our business from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and review trends in the data. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and enhanced based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. • Information Sharing and Collaboration: We share and receive threat intelligence and best practices with industry peers, government agencies, information sharing and analysis centers, industry trade organizations, and cybersecurity forums. These relationships enable the rapid sharing of information around threat and vulnerability mitigation. • Third-Party Risk Assessments: We engage third-party services to conduct assessments of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of security controls. • Companywide Policies and Procedures: We have companywide cybersecurity policies and procedures, such as encryption standards, antivirus protection, remote access protocols, multi-factor authentication, protection of confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by the appropriate members of management. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform simulations and other exercises with management and incorporate external resources and advisors as needed. Our team of cybersecurity professionals collaborate with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's risk management program. The Board and Audit Committee receive reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and vulnerabilities. Additionally, management provides the Audit Committee with updates on cybersecurity risk assessments, risk mitigation strategies, and relevant internal and industry cybersecurity matters. The Company's Chief Information Officer ("CIO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board and Audit Committee. The Company's CIO has 25 years of experience in the information technology industry. The CIO reports to the Chief Executive Officer and is supported by a dedicated cybersecurity team within our information systems department, as well as a multidisciplinary incident response team. Employees across the organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity posture.


text: In addition, the Company's Risk Management Committee ("RMC") evaluates risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The RMC is comprised of members of the executive leadership team. The RMC meets monthly and receives updates from the CIO or a member of our cybersecurity team. The RMC reviews security performance metrics, global security risks, security enhancements, and updates on our security posture.


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cyber incident that could adversely impact our ability to operate its core business functions. As a financial services firm, we do not maintain a significant level of personally identifiable information data. Accordingly, our exposure to data breaches is more limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a comprehensive cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling information security incidents involving assets or data. It guides our computer security incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates from management on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.


text: Our Chief Information Officer leads our overall cybersecurity function and is responsible for developing and implementing our information security program and managing our response to threats. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT security team, including the third party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filters non-security events, and then correlates the information using security data analytical engines so that personnel can identify and analyze threats.


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, the employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks. We also conduct independent audits on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.


text: With respect to our software platforms that are hosted by third parties, we utilize an external vendor risk management platform is utilized to evaluate, rate, monitor and track vendor risk. The security practices and processes of the service providers are monitored regularly, and periodic audits are performed on the security adequacy and compliance of the service provider. For any of our hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.


text: Risk Management and Strategy We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our management, with input from our Board of Directors, performs an annual enterprise-wide risk management ("ERM") assessment to identify and manage key existing and emerging risks for our company. Our ERM process assesses the characteristics and circumstances of the evolving business environment at the time and seeks to identify the potential impact, likelihood and velocity of a particular risk. Our senior executive management team has the overall responsibility for, and oversight of, our ERM process, and senior executives are assigned to monitor and manage top identified risks. Cybersecurity is among the top risks identified for oversight as a result of our last annual ERM assessment.


text: Systems and process monitoring are essential components of our cybersecurity risk management and information security programs. Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a framework for materiality determination and a reporting-up process to assist in a disclosure of a material event, if required. In addition, management has defined key roles and responsibilities within our organization to handle material cybersecurity incidents. A comprehensive incident response plan is utilized for any threat activities identified, including timely containment, analysis, remediation, and communication, and is also applicable to third parties with access to our information systems or assets. We have implemented security programs, such as mandatory cybersecurity awareness training for all our employees, simulated phishing emails and tabletop exercises, that are strategically designed and continuously updated to address evolving cybersecurity threats and latest industry trends. These programs, which are held multiple times a year, allow our employees to both identify and address material cybersecurity incidents, utilizing our comprehensive incident response plan.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and monitoring our cybersecurity programs and assets. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity risk management, strategies and processes remain at the forefront of industry best practices.


text: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including security assessments of all third-party providers before engagement. In addition, cybersecurity program maturity of such third parties, including incident response and disclosure, is also evaluated.


text: To date, our business strategy, results of operations or financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. For more information on our cybersecurity related risks, see "Item 1A—Risk Factors—Risks Relating to Our Business" in this Annual Report on Form 10-K.


text: Our Board of Directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit and Risk Committee assists the Board of Directors in its responsibilities of overseeing cybersecurity risk. Our Chief Operating Officer ("COO") and Chief Information Security Officer ("CISO") play a pivotal role in informing the Audit and Risk Committee on cybersecurity risks. They report to the Audit and Risk Committee on a quarterly basis on a broad range of topics, including assessments and scoring of our information security program; incident management, the incident response plan and the status of security tools; the current cybersecurity landscape and emerging threats; and the status of ongoing cybersecurity awareness and training and projects to strengthen our information security systems. Additionally, our Executive Director, Internal Audit presents a quarterly report on our enterprise risk management activities, including cybersecurity risks, to the Audit and Risk Committee. The chair of the Audit and Risk Committee, in turn, periodically reports on its review with the Board of Directors, and our COO and CISO report annually to the Board of Directors regarding our cybersecurity program and risk management.


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy and managing our cybersecurity threat detection and response plan. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.


text: Cyber Risk Management and Strategy We have implemented and maintain an ongoing cybersecurity risk management program, under the oversight of the audit committee of the board of directors, that is focused on identifying, assessing and mitigating cyber risk. We engage with multiple third-party vendors who provide a variety of services ranging from ongoing security advisory services to security monitoring and response management. In addition, we also have a process to assess and review the cybersecurity practices of third-party vendors and service providers, including through the use of vendor questionnaires and contractual security requirements, as appropriate. In addition to these efforts, we have implemented an ongoing enterprise risk management program that includes processes designed to identify, assess, and address cybersecurity risks. Our cybersecurity efforts are informed by industry standards and include periodic, targeted risk assessments supported by cybersecurity technologies, including third-party security solutions and monitoring tools, designed to monitor, identify, and address cybersecurity risks.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Additionally, as a public company, we are subject to various regulatory requirements around our internal controls, including our controls around our information technology systems and their impact on our financial statements or systems. We have engaged a third party vendor to advise us on our compliance with these requirements, including around our controls related to cybersecurity, and strategies to mitigate related risk. If we were to identify any control deficiencies that represent cybersecurity risks, those would be reported to the Chief Financial Officer and the audit committee, together with plans for corrective action, as appropriate.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are managed by our Director of Information Technology, in consultation with the legal and human resources teams. Currently, the Director of Information Technology role is held by an individual who has over 17 years of cybersecurity, information technology, and systems engineering experience. The Director of Information Technology reports to the Chief People Officer.


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis.


text: Risk Management and Strategy We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We maintain technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.


text: From time to time, our processes are audited and validated by internal and external experts. We leverage third-party cybersecurity experts with the goal of minimizing disruption to our business and production operations, strengthening supply chain resilience in response to cyber-related events, and supporting the integrity of IT systems. We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration tests to help identify exploitable cybersecurity vulnerabilities. Our IT team assesses these testing results and implements any appropriate measures to mitigate vulnerabilities identified.


text: We have not experienced any material impacts from any cybersecurity threats or incidents in the last three fiscal years. We use each cybersecurity threat or incident as an opportunity to review our protocols and implement enhancements as applicable. For more information about our risks from cybersecurity threats, see Item 1A—Risk Factors—A failure of one or more of our key information technology ("IT") systems, networks, processes, associated sites, or service providers could have a negative impact on our business.


text: Our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks, and is assisted in these efforts by the Audit Committee of the Board. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reports directly to our Chief Financial Officer. During 2023, our Chief Information Officer (who has been serving as our Chief Commercial Officer since January 2024) provided updates on cybersecurity threats and risks to our Board of Directors and to the Audit Committee of our Board of Directors. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2023, as part of their oversight of our enterprise risk management process.


text: Our Vice President of Information Technology and Security has over 25 years of experience in IT and has held a variety of IT roles across multiple business lines within the financial services, aviation, and hospitality industries. He received both his bachelor's and master's degrees in information management and holds Certified Information Systems Security Professional ("CISSP") certification.


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Chief Executive Officer and Chief Financial Officer, as appropriate.


text: Risk management and strategy With respect to cybersecurity risks, we have invested and continually invest in new cybersecurity services, technologies, and capabilities. On an ongoing basis we provide our employees with comprehensive cybersecurity awareness training around phishing, malware and other cybersecurity risks, all in a manner reasonably intended to educate employees to safely avoid cyber attacks and mitigate the risk of employee related security breaches. In support of our cybersecurity program, our systems and services undergo regular reviews by management to determine if any insufficiencies in cybersecurity exist.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: If an incident is detected, the Cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the Cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that Cybersecurity incident is determined to be material, the appropriate public disclosures are made.


text: We monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and reevaluate these risks periodically. We also perform third-party cybersecurity audits at least annually and conduct third-party security reviews and testing of our network, processes and systems periodically.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition We rely on our computer networks and systems, some of which are managed by third-parties, to manage and store electronic information (including sensitive data such as confidential business information, personally identifiable data and personal health information), and to manage or support a variety of critical business processes and activities. We may face threats to our networks from unauthorized access, security breaches and other system disruptions. Despite our security measures, our infrastructure may be vulnerable to external or internal attacks. Any such security breach may compromise information stored on our networks and may result in significant data losses or theft of sensitive or proprietary information. A cybersecurity breach could hurt our reputation by adversely affecting the perception of customers and potential customers about the security of their orders and personal information, as well as the perception of our manufacturing partners of the security of their proprietary information. In addition, a cybersecurity attack could result in other negative consequences, including disruption of our internal operations, increased cybersecurity protection costs, lost revenue, regulatory actions or litigation. Any disruption of internal operations could also have a material adverse impact on our results of operations, financial condition and cash flows.


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our Board actively oversees our corporate strategy and enterprise risk management ("ERM") programs, including those relating to cybersecurity and data privacy risks.


text: Our Audit Committee and Nominating and Corporate Governance Committee are primarily responsible for, among other things, overseeing our compliance and ERM programs, information technology systems, and our processes and data, including cybersecurity and data privacy. These responsibilities include reviewing and discussing with management our policies and processes relating to risk assessment and risk management. Cybersecurity and data privacy are regular topics on the Audit Committee's agenda and management reviews at least quarterly the results of cybersecurity monitoring and discusses performance metrics, any incidents identified and potential recommended modifications to our technology, organization training, awareness and governance with our Audit Committee. A summary of these results are also reported by the Audit Committee to the Board at least annually.


text: Management, including our Chief Information Officer ("CIO"), who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.


text: Cybersecurity Program Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security ("GIS") team has day-to-day responsibility for Spirit's cybersecurity program. This group is led by a Chief Information Security Officer ("CISO") with more than twenty years of audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Enterprise Security Council comprised of GIS, Information Technology, Legal, Compliance, Internal Audit, and Enterprise Risk Management meets regularly to discuss emerging cyber risks and corresponding mitigations as part of our overall Enterprise Risk Management program. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.


text: The CISO monitors and reviews our process of patching compliance, which is managed and executed via a combination of internal resources and third-party service providers. We also use third parties to supplement monitoring of cyber activity and for various special projects, which may include projects related to cybersecurity.


text: As part of our cybersecurity risk management program, we have planned "tabletop" exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive Leadership Team. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents.


text: GIS maintains an Incident Management and Response Policy that provides a classification framework for cybersecurity incidents and defines critical roles and responsibilities during a cybersecurity incident. The Incident Response Policy specifies ownership and timing of key actions and prescribes the engagement of functional leaders, senior Executives, and the Board of Directors, depending on the incident. We have developed playbooks to guide specific actions related to different incident types. Finally, we have a cyber insurance policy underwritten by a global leader in commercial insurance solutions.


text: Part of our Enterprise Risk Management program involves understanding risks that third parties, including those that our supply chain introduce to our organization. Our cybersecurity program is in the process of maturing how we assess third-party cyber risks, particularly in situations where we share confidential or sensitive information, or in situations where our operations may be impacted through a cybersecurity incident at a third party.


text: Cybersecurity Governance The Board of Directors' Risk Committee has the responsibility for oversight of our cybersecurity program. This committee's membership includes subject matter experts in both cybersecurity and national security. Spirit's CISO reports to the Risk Committee quarterly on the state of our cybersecurity program.


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations, or financial condition, during the period covered by this report, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors – Risks Related to Our Operations"


text: Risk Management and Strategy We have a cybersecurity risk management program consisting of policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these policies and procedures into our overall risk management systems and processes. Our cybersecurity policies and procedures are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We routinely assess material risks from cybersecurity threats and regularly assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations.

companyName: Block, Inc.

ticker: XYZ


text: Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures. Our employees participate in cybersecurity training and awareness upon hire and at least annually thereafter.


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, standards, architecture, processes, and significant risks, as well as overseeing responses to security and data incidents, as appropriate.


text: The full board of directors undergoes annual information security and privacy training by our Chief Information Security Officer ("CISO") and our Chief Privacy Officer ("CPO"), which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, from our CISO and CPO on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit committee provides regular updates to the board of directors on such reports.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our foundational engineering, data security governance, infrastructure security, product security and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Chief Financial Officer and Chief Operating Officer and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.


text: Our CISO and Deputy CISO are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has served in various roles building and securing enterprise platforms across retail, corporate and investment banking financial services as well as consumer experiences and data at multiple Fortune 500 companies for over 25 years. Our Deputy CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our Deputy CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Our CISO is responsible for developing, implementing, and maintaining our information security strategy and program, as well as reporting various cybersecurity risk matters to our IT Steering Committee, and the Board's Innovation Committee. The Innovations Committee is a subset of the full Board of Directors which receive regular updates on our cybersecurity program.


text: Our CISO has over 17 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers on a limited basis is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements when it becomes effective.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have not materially affected or are not reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see Risk Factors included in Part I, Item 1A of this Form 10-K.


text: Cybersecurity Oversight Our Board of Directors is responsible for ensuring that the Company has effective procedures for assessing and managing risks to the Company's operations, financial position, and reputation. The Board has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for risk assessment and risk management. Cybersecurity represents an important component of our overall approach to enterprise risk management. The Audit Committee receives regular reports, including twice annually from our Chief Information Security Officer ("CISO"), on a wide range of cybersecurity topics, including our cybersecurity program's performance, emerging threats, capability enhancements, recent developments, evolving standards, technological trends and other relevant topics. The Audit Committee also receives an update at least quarterly on the Company's cybersecurity metrics and key performance indicators. Executive leadership is continually apprised of developments pertaining to our cybersecurity program through electronic communications and senior leadership meetings.

companyName: Crane NXT, Co.

ticker: CXT


text: Cybersecurity Roles and Capabilities Our CISO, in coordination with members of our senior leadership team such as our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats. Through ongoing communications with these teams, our CISO and senior leadership team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.


text: Our CISO is responsible to communicate potential and actual cybersecurity incidents to our senior leadership team in a prompt manner. We have established internal reporting processes so that the Board of Directors and the Audit Committee promptly will receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Such processes are evaluated on a regular basis. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including outside advisors to the extent appropriate.


text: Our CISO, reporting to our CFO, leads our cybersecurity program. Our CISO has more than 20 years of cybersecurity experience and holds CISSP (2002) and CISM (2009) certifications. The cybersecurity team reporting to our CISO is staffed by highly skilled cybersecurity professionals, including both internal staff and external partners. Many team members have one or more industry recognized cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager/Auditor (CISM/CISA). In addition, our CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have extensive experience managing risks at Crane NXT and at similar companies.


text: Our security operations team is responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. This team consists of both internal employees located in several countries as well as a partner organization who supports our security operations team 24/7.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management programs and are based on recognized frameworks and other applicable standards. Our cybersecurity program has comprehensive processes for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. Our program has adopted and implemented an approach to identify and mitigate cybersecurity risks that include commercially reasonable technologies for companies with similar risk profiles.


text: Our cybersecurity program is regularly assessed through activities such as penetration tests, internal audit assessments, an annual external PCI compliance audit in the CPI business, and ISO 27001 re-certification in the Currency business. The results of these assessments are reported to our Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices to reduce cybersecurity risk based on the information provided by these exercises and assessments. Our cybersecurity team also conducts an annual incident response exercise that includes executive leaders to ensure alignment should we experience a cybersecurity incident.


text: We provide regular training and awareness for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Cybersecurity Identified Risks As of the date of the filing of this Current Report on Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to affect, us, including our business strategy, results of operations, or financial conditions.


text: We could be adversely affected in the future by any information system or technology network failure or breach in data security, including any such failure or breach involving personally identifiable or other confidential information, any non-compliance with our contractual or other legal obligations regarding such information, or any violation of our privacy and security policies with respect to such information. See also Item 1A, Risk Factors, "Information systems and technology networks failures and breaches in data security, personally identifiable and other information, non-compliance with our contractual or other legal obligations regarding such information, or a violation of our privacy and security policies with respect to such information, could adversely affect us."


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook and Cyber Assessment Tool, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: SLM Corp

ticker: SLM


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Operational and Compliance Risk Committee of the Board. The Operational and Compliance Risk Committee of our Board of Directors oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security Officer ("CSO") reports to our Chief Operational Officer and President of the Bank and leads the Company's overall cybersecurity function. Our CSO provides periodic updates on our cybersecurity risk management program to the management-level Operational and Compliance Risk Committee ("OCRC") and Executive Committee ("EC"). The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CSO is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for leading our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CSO has significant executive experience in managing and leading IT and cybersecurity teams in both government and the private sector and has received industry recognition in the cybersecurity area. Our CSO holds cybersecurity certifications from leading cybersecurity training and research institutes, is a Fellow at the National Security Institute, and is a member of the Board of Directors of the Financial Services Information Sharing and Analysis Center.


text: The proper confidentiality, integrity, and availability of the Company's information systems are critical to the business. Securing the Company's business information, customer, patient and employee data, and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements, and maintaining the trust of its stakeholders. As part of its enterprise risk management program, the Company has processes in place to assess, identify, and manage material business, operational and legal risks from cybersecurity threats. Such risks include business disruption, fraud, extortion, reputational harm, violations of laws and regulations, litigation, and harm to employees, patients, customers and business partners.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: Cybersecurity Program Overview The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.


text: Board Oversight of Cybersecurity Risks The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. Additionally, Concentra receives a certified System and Organization Controls 2, Type 1 assessment, a voluntary compliance standard for ensuring that the Company properly manages and protects the sensitive data in its care, conducted by an independent and qualified external third-party assessor. The Company has not experienced a cybersecurity breach or information security breach during the past three fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who is responsible, along with his team, for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO has served in that role since 2021 and has been in cybersecurity related roles for 25 years, including with two publicly traded companies. Our Board of Directors has delegated oversight of risks from cybersecurity threats through our information security program to our Audit Committee, which receives updates on an as needed basis from our CISO regarding risks from cybersecurity threats. Our CISO additionally provides periodic updates to our Board of Directors, our Chief Executive Officer and other senior management members, including at least twice per year through our overall Enterprise Risk Management Program. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: Our information security program leverages components from industry frameworks and generally recognized best practices, including International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, such as the NIST Cybersecurity Framework, which emphasizes identification, protection, detection, response and recovery. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors. We also collaborate with thought leaders in cybersecurity including with key vendors, clients, business partners, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and improve the effectiveness of our information security policies and procedures. This collaboration allows us to rapidly adopt industry best practices developed through firsthand experience mitigating cyber incidents. Our program also includes processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity program intended to manage risk, and protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan as well as key technology and processes required to monitor, alert and escalate in the event of malicious activity.

companyName: ARDELYX, INC.

ticker: ARDX


text: We design, assess and benchmark our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, in areas such as legal, compliance, strategic, operational, and financial risk.


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: Cybersecurity Governance Our board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Compliance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program, maintains a strategic role in coordinating cyber risk initiatives and policies, and confirming their efficacy.


text: The Committee receives regular reports from management on our cybersecurity posture. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives periodic briefings from management on our cybersecurity program. The Board members receive presentations on cybersecurity topics from our IT Senior Director, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Legal Officer, Chief Financial Officer and IT Senior Director, has over a combined 50 years of risk management experience, including our IT Senior Director who has over 15 years of experience overseeing cybersecurity and risk management. This team is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes experience running cybersecurity programs at similarly situated commercial biotechnology organizations and navigating the associated risk landscape.


text: We acknowledge the evolving nature of cyber threats to our business and industry. The Board oversees management's processes for identifying and mitigating cybersecurity risks to help align our risk exposure with our strategic objectives. To that end, cybersecurity risk management is integrated into the Company's overall enterprise risk management function. The Company utilizes a combination of processes and systems designed to assess, monitor, and respond to organizational cybersecurity risks in an effective manner across our operations. The cybersecurity risk management program includes regular assessments, providing a holistic view of our risk posture; this contributes to the ongoing improvement of our process, cybersecurity program, and security position.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Understanding the importance of cybersecurity, the Board maintains oversight of the cybersecurity risks and threats within the organization. Specifically, Board has delegated authority to the Audit Committee to oversee risk management relating to cybersecurity. The Audit Committee is composed of members with various expertise including risk management, technology, and finance.


text: The Company's information security program is managed by a dedicated Vice President (VP) of Security Compliance and Risk Management (VP of Security), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, and who reports directly to the Chief Information Officer (CIO).


text: The Company's Security and Privacy Steering Committee, which meets on a regular basis, also provides oversight of our security and privacy programs inclusive of defining the security strategy, reviewing risks and risk management strategies, and program performance. The committee (chaired by the VP of Security) comprises a broad selection of Senior Management leaders within the organization. This facilitates enterprise-wide collaboration in aligning cybersecurity objectives with organizational goals.


text: The VP of Security reports regularly to the CIO and the Security and Privacy Steering Committee. Further, the CIO provides regular reports to the Audit Committee and to the full Board. Reports include updates on our cyber risks and threats, projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Standards Based Program We use our best efforts to align our cybersecurity risk management with industry best practices, including processes to prevent, identify, assess, treat, monitor, and report on organizational risks. We design and assess our program utilizing tools such as the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these tools as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This covers Company owned and managed systems and technologies, along with those supplied to the organization by third parties.


text: Evolving Threats The program utilizes various resources, inclusive of third-party partners, to support an awareness and understanding of evolving cybersecurity threats, allowing the organization to be actively engaged in understanding and staying abreast of risks, and thereby supporting informed decision-making.


text: Incident Response Our strategy includes a formal Incident Response Plan, designed to help the organization prepare for, respond to, and recover from confirmed or suspected cybersecurity or privacy incidents. Further, it evaluates and validates the effectiveness of our incident response capabilities, and allows for improvements as needed.


text: During the course of normal business operations, the Company collects, stores, and processes personal data. Being cognizant of the importance of protecting personal data and respecting the rights of individuals to have control over their personal information, the organization implements a data privacy program designed to comply with U.S. data privacy regulations and incorporates data privacy into its risk management program.


text: Training and Education Our enterprise-wide awareness and training program is utilized to mitigate risks by educating users on their role in combating security breaches, following good security practices, and maintaining awareness of security risks associated with their actions. This program includes mandatory and optional activities inclusive of online training, presentations, newsletters, blog posts, and simulation exercises.


text: Use of Third Parties Being cognizant of the complexity and dynamic nature of cybersecurity threats, the Company engages the services of various third-party experts, inclusive of Managed Security Service Providers, application and infrastructure cybersecurity assessors, consultants, and advisors. These engagements allow for the supplementing of our internal capabilities with specialized knowledge and expertise in the execution of cybersecurity strategic functions.


text: Third-Party Risks Given that risks associated with third parties can adversely impact an organization's overall security and risk posture, the Company implements a third-party risk management program to assess the security posture of third-party service providers. This includes security assessments prior to service engagement and ongoing monitoring.


text: The Company understand that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.


text: C. Management's Role and Expertise Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the VP of Security, Compliance, and Risk Management, who has over 15 years of dedicated experience in the field of cybersecurity across multiple industries. Their background includes extensive experience in cybersecurity program development, leadership, and risk management, which is instrumental in the execution of our cybersecurity strategies. Some specific responsibilities include overseeing our governance and compliance, risk management (identification, assessments, and treatment), and security and privacy awareness programs.


text: The Company's Chief Information Officer (CIO) possesses a wealth of information technology expertise and has served in various technology leadership roles across multiple industries. They are responsible for all technology systems, services, and solutions. The cybersecurity function reports directly into the office of the CIO.


text: The Company, its management and its Board understand the critical importance of cybersecurity in maintaining the trust, confidence and support of customers, employees, and other stakeholders. The Company, as a supplier of products of critical digital infrastructure technologies to our customers, is reliant on technology and information systems that may comprise part of the products we sell or the services that we provide. As a worldwide business, we have also become increasingly dependent on digital technologies, including information systems, infrastructure and cloud applications and services, to operate our businesses, process and record financial and operating data (including processing customer orders, shipping products, billing our customers, and tracking inventory), communicate with our employees and business partners, and perform other activities related to our businesses. Our evolution into smart products, Internet of Things, business-to-consumer, and e-commerce subjects us to increased cyber and technology risks. The secure operation of our information technology systems and networks and ensuring that we have skilled personnel to assist in ensuring their continued security is critical to our business operations and strategy.

companyName: Vertiv Holdings Co

ticker: VRT


text: Our cybersecurity program aims to provide a robust, dynamic and secure environment that protects the confidentiality, integrity, and availability of this data. Our cybersecurity program has a fully defined set of documentation that is aimed at identifying, assessing and responding to cybersecurity risks. Our implementation of various internal and external controls and processes, including appropriate internal risk assessment and internal policy implementation, incorporating a risk-based cyber security framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities and infrastructure, is discussed below. In addition, we provide disclosure and discussion with respect to the following facets relating to the Company's cybersecurity program (a) our risk management processes and overall strategy for addressing cybersecurity threats and incidents within the context of our information systems (each as defined in Item 106 of Regulation S-K); (b) the potential impact of cybersecurity threats on our business strategy, results of operations, and financial condition; and (c) the respective roles of the Board in overseeing, and the Company's management in assessing and managing, cybersecurity threats and cybersecurity incidents.


text: Risk Management and Strategy Processes for Assessing, Identifying, and Managing Cybersecurity Threats: The Company maintains a fully defined set of documentation for assessing, identifying, and managing material risks from cybersecurity threats. We recognize the risk that cybersecurity threats pose to our operations, and cybersecurity is an integral component of our overall enterprise risk management (ERM) strategy. Our cybersecurity framework is aligned with the National Institute of Standards and Technology's special publication 800-53 and is comprised of the following four main pillars:


text: Risk Governance: The Company's cybersecurity program utilizes a cross-functional approach to addressing cybersecurity risks and engages in discussions with the Board (or a committee thereof) and our executive officers accordingly on an as-needed basis. The Company's cybersecurity processes are implemented to help ensure that the Company's cybersecurity practices are aligned with the Company's overall ERM standards and practices. The Company has formed a Cyber Risk Oversight Committee (CROC) to oversee the Company's cybersecurity program. Our CROC, in turn, communicates any unresolved risks to the Company's Enterprise Risk Committee (ERC) and the ERC interacts with the Board, the Audit Committee and executive management on a regular interval, or more frequently (if necessary) in regard to such risks. Currently, the CROC is comprised of representatives of our IT department as well as senior leadership, including all direct reports to our CEO. The ERC is comprised of our Chief Legal Counsel, Senior Director of Global Risk Oversight and various heads of regional or global business units and corporate functions, including but not limited to, IT, finance, accounting, legal, and human resources.


text: Risk Identification: We have developed risk identification and vulnerability management procedures that address the identification, prioritization, and remediation of cybersecurity vulnerabilities. To facilitate this program, the Company has created a risk register to assess and monitor potential risks. As discussed below, the Company uses certain third-party tools to identify and manage cybersecurity vulnerabilities. Each risk in the risk register is monitored by one of our cybersecurity members and updates are reported to the CROC as needed.


text: Risk Assessment: The Company generally evaluates risks, including cybersecurity risks, based on probability, impact and proximity. As part of its program, the Company conducts formal cybersecurity risk assessment exercises at least bi-annually. The Company has documented processes and protocols in order to delineate unacceptable levels of risk and assess such risks based on a number of factors.


text: Risk Response: We have developed various playbooks that comprise a comprehensive written incident response plan (collectively, our IRP). This IRP describes the procedures for handling a variety of cybersecurity incidents; categorizes the types of potential cybersecurity incidents and the timeframe for reporting each; establishes cybersecurity incident response levels; provides for the conducting of legally privileged investigations to enable us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident, including but not limited to, the process to escalate risks to our Board, Audit Committee and our executive management, as necessary. Incidents with respect to third parties are managed internally using the same basic processes as managing internal cybersecurity incidents.


text: Third-Party Risk Management: The Company's comprehensive approach to cybersecurity and its associated risk management framework requires, when applicable, the engagement of certain third parties, which could include law enforcement, vendors, and other software or service providers. The Company leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. These third parties assist with various cybersecurity functions including monitoring, threat detection, vulnerability management, network segmentation, mobile device management, data protection, tabletop exercises, semi-annual penetration testing, multi-factor authentication, and threat intelligence.


text: Education and Awareness: In consultation with our cybersecurity team, we mandate annual cybersecurity awareness training for Company personnel, and regularly conduct simulated phishing attacks as a means to equip them with effective tools to detect and address cybersecurity threats as well as to communicate our evolving cybersecurity policies, standards, processes, and practices in the context of its information systems.


text: Impact of Cybersecurity Threats: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition.


text: Board Oversight of Risks from Cybersecurity Threats: The Board is ultimately responsible for the oversight of risks from cybersecurity threats and collaborates with the Audit Committee of the Board and the ERC in these oversight responsibilities. The responsibilities of the ERC include participating and collaboration with the CROC to oversee policies and management systems for cybersecurity matters, overseeing the identification, assessment and response to cybersecurity risks, maintaining and implementing our IRP, and communicating on a regular interval, or more frequently (if necessary) with the Board, the Audit Committee and executive management in regard to such risks. The Company's processes call for prompt and timely notifications and updates to the Board and the Audit Committee, as applicable and as necessary depending on the nature and severity of the incident, in connection with any cybersecurity incidents that may occur. In addition, the Board, the Audit Committee, and the ERC receive regular presentations and reports on cybersecurity matters that address the full range of cybersecurity topics discussed herein. Further, on a periodic basis, the Board and/or Audit Committee and the ERC also discuss our cybersecurity programs and processes with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO).


text: Management's Role in Assessing and Managing Cybersecurity Threats: Management's role in assessing and managing our material risks from cybersecurity threats is documented in the Company's IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of all of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents.


text: Upon the discovery of a potential or actual cybersecurity incident, the detecting party is obligated to inform the CISO, or deputy CISO if the CISO is unavailable, as an initial step. We also employ the services of an outside vendor that is tasked with contacting the CISO, or the CISO's delegee, upon learning of an incident. Subsequently, our CISO will guide the initial analysis of the cybersecurity incident, and depending on the nature of the incident, these cybersecurity incidents may be escalated to our CIO and above according to the guidelines set forth in the IRP. Analysis of the potential impact of the cybersecurity incident is one of the primary objectives of our initial response. Once the severity level and appropriate management protocol for responding to the cybersecurity incident have been determined in accordance with our Cybersecurity Plan and IRP, the CIO, or the CIO's delegee, may elevate the incident to the CEO, Chief Legal Counsel, Board, and Audit Committee as needed (depending on the nature and severity of the incident) for further investigation and response, including for an assessment of materiality. Depending on the nature of the incident, the CIO or Chief Legal Counsel will coordinate a notification and communications plan and event analysis across the appropriate teams, which may involve updates to our cybersecurity management team, the Board, the Audit Committee, the ERC and the CROC.


text: Relevant Expertise of Management: Our CISO has more than 20 years of intelligence, information technology and cybersecurity experience, and holds a Masters degree in the area of Cybersecurity and Information Sciences from The Pennsylvania State University. His prior roles include senior level positions in Defense, Financial Services and High Technology industries. Our CIO has more than 30 years of information technology and cybersecurity experience at various levels. She holds an executive MBA from the Quantic School of Business and Technology, a Graduate Certificate in SAP from Central Michigan University, a Masters in computer information systems from Grand Valley State University and a BA from the University of Michigan. Her prior roles include positions as Chief Information Officer and Vice President of Information Technology and Digital Office of Adient plc, a global automotive seating manufacturer, and Chief Information Officer and Vice President of Information Technology, Power Solutions of Johnson Controls.