text: Our CISO reports directly to our Chief Legal and Administrative Officer and Secretary. The CISO closely monitors our cybersecurity program, including our strategy and cybersecurity policies and practices, against the cybersecurity threat landscape. As described above, our cybersecurity incident response plan provides a framework for a multidisciplinary team to prevent, detect, mitigate, and remediate cybersecurity-related risks and incidents. This framework also sets forth parameters for the escalation and reporting of cybersecurity risks and incidents to broader groups at the Company, and the CISO reports information about significant cybersecurity risks and incidents to the Audit Committee on a regular basis and more frequently if warranted under the circumstances.


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives regular reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.

companyName: MGM Resorts International

ticker: MGM

secItem: Item 1C


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has over 20 years of expertise in technology, cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information security throughout his career. The CISO holds various professional certifications, including Certified Information Security Manager certification from the Information Systems Audit and Control Association and Certified Incident Handler from the International Council of E-Commerce Consultants. The CISO holds a Bachelor of Science Degree in Cyber Security & Information Assurance.


text: The Company maintains a cybersecurity program that is aligned with its business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into its overall risk management processes and governance structure.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: The Company has implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. The Company also maintains third party management processes to identify and manage the cybersecurity risks associated with third party service providers. The Company periodically evaluates its cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, the Company has a Cybersecurity Task Force in place that is comprised of individuals across various departments within the organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance the Company's cybersecurity strategy.


text: The Board of Directors (the "Board") oversees NACCO's risk management. The full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of the Company's cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2023, the Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.


text: The Company's Chief Information Security Officer ("CISO") leads the Company's cybersecurity program and is responsible for the management of its cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO is currently enrolled in an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence ("AI"). The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company has an established process governing its assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to the Company's executive management and/or Board.


text: As of the date of this filing, the Company's business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, we cannot provide assurance that they will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding the Company's cybersecurity risks, please refer to "Item 1A - "Risk Factors" on page 19.


text: Cybersecurity continues to be a key governance priority for us. NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure.


text: We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, we have a Cybersecurity Task Force in place that is comprised of individuals across various departments within our organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance our cybersecurity strategy.


text: Our Board of Directors (Board) oversees NACCO's risk management. Our full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of our cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2024, our Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.


text: Our Chief Information Security Officer (CISO) leads NACCO's cybersecurity program and is responsible for the management of our cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO successfully completed an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence during 2024. The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to our executive management and/or Board.


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, NACCO cannot provide assurance that we will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding our cybersecurity risks, please refer to Item 1A - Risk Factors on page 18.


text: Cybersecurity presents significant challenges to the business community in general, including to the financial services industry. Increasingly, bad actors, both domestic and international, attempt to steal personal data and/or interrupt the normal functioning of businesses through accessing individuals' and companies' files and equipment connected to the internet. Recent incidents have reflected the increasing sophistication of intruders and their intent to steal personally identifiable information as well as funds and securities. These intruders sometimes use instructions that are seemingly from authorized parties but in fact, are from parties intent on attempting to steal. In other instances these intruders attempt to bypass normal safeguards and disrupt or steal significant amounts of information and then either release it to the Internet or hold it for ransom. Regulators are increasingly requiring companies to provide heightened levels of sophisticated defenses. The Company maintains processes and systems with an aim to preventing any such attack from disrupting its services to clients as well as to prevent any loss of data concerning its clients, their financial affairs, as well as Company privileged information.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Our management is actively involved in the oversight of our cybersecurity risk management program, We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.


text: We have a written incident response plan that identifies the steps to be taken in response to a cybersecurity incident that includes investigation, escalation and remediation provisions. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which may include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.


text: Management's Role Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CIO and the Company's CISO, who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.


text: The CEO meets regularly with the CIO to discuss cybersecurity threats and existing and potentially new technology systems including those related to cybersecurity. The CIO and CISO have a standing monthly meeting with the President and General Counsel to discuss potential vulnerabilities in the cyber environment. The President formerly ran the Information Technology Department at the firm and as a result has significant systems experience including experience related to cybersecurity.


text: The Board of Directors, both directly and through the Audit Committee, oversees Management's responsibility of ensuring proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate cybersecurity risks. The Audit Committee receives a cybersecurity update at each regular meeting of the Board covering cybersecurity risks, cybersecurity staffing and staff development including certifications and training. These updates are given either in person by the CIO and CISO or in written presentations created by them.


text: As of the date of this filing, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company's business strategy, results of operations or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Given the continuing reports of cyber incidents in general, we believe that the Company will most likely continue to be a target of cybersecurity attacks by bad actors.


text: For additional information on how risks from cybersecurity threats may adversely affect the Company see "Item 1A. Risk Factors-Risks Related to Our Business" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our management is actively involved in the oversight of our cybersecurity risk management program. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants and auditors to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which does include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.


text: Management's Role Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's Chief Information Officer ("CIO") and the Company's Chief Information Security Officer ("CISO"), who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.


text: The Board of Directors, both directly and through the Audit Committee, oversees management's responsibility of ensuring proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate cybersecurity risks. Recently the Audit Committee added a member with significant cybersecurity experience. The Audit Committee receives a cybersecurity update at each regular meeting of the Board covering cybersecurity risks, cybersecurity staffing and staff development including certifications and training. These updates are given either in person by the CIO and CISO or in written presentations created by them.


text: Risk Management and Strategy We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic Business Impact Assessments ("BIAs") of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We utilize internal information technology resources for the primary aspects of our cybersecurity program. Our internal team is supported by external service providers and consultants as needed.


text: To minimize the risk to our core systems, we utilize well established enterprise-grade cloud service providers for our management and operational functions. We review Service Organization Control Type 2 audit report results from each of these service providers to ensure that their programs meet our requirements.


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging people, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees and periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.


text: Our cybersecurity strategy and risk management program is a component of our overarching enterprise risk management program and interfaces with other functional areas within the Company, including our business segments, legal, risk, human resources and internal audit departments.


text: While we have experienced cybersecurity incidents in the past, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business or financial condition. However, there can be no assurance that we will not suffer a significant event in the future that could materially affect our business, financial position, results of operations or cash flows. For more information on how cybersecurity risk may materially affect our business, financial positions, results of operations or cash flows, please refer to Part I, Item 1A. Risk Factors hereof.


text: Our Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our CFO. Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity have over 19 and 20 years, respectively, of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.


text: As part of our defined cybersecurity policies and cybersecurity incident response plan, management is regularly updated on the status of the execution of our cybersecurity strategy and daily operations of the program. This includes regular reporting and evaluation of all cybersecurity incidents, not only those that may be deemed material.


text: Our CIO, supported by our Director of Cybersecurity provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any non-material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.


text: In the event of a material cybersecurity incident, communication to the Board is provided pursuant to our cybersecurity incident response plan.


text: Risk Management and Strategy We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic business impact assessments of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations. • Periodic penetration testing of our internal and external IT environment to validate the real-world efficacy of our cybersecurity program and mitigate the risks of new cybersecurity vulnerabilities.


text: We utilize third-party service providers to manage portions of our business operations. We have established processes to review, identify and manage cybersecurity risks associated with the use of service providers. Prior to engaging these providers, we review the providers' SOC 2 Type II or other relevant security audit reports to ensure proper security controls are in place. We evaluate the service providers' controls for incident response strategy to identify any significant risks and adapt accordingly. We systematically review these assessments for any significant change throughout the relationship. Our risk management program consistently monitors for risk to our systems and services presented by these service providers and promotes strategies to address any threats identified.


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging our people, external resources, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis. Additionally, we have a retainer for external forensics support if required for a material incident.


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees, periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer ("CEO"). Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.


text: Our CIO, supported by our Director of Cybersecurity, provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.


text: Under our "Cloud First, Cloud Now" strategy, we are increasingly relying on cloud-based technology to enable more innovation, enhance customer service, and keep up with the complex demands of the ever-changing trucking and logistics landscape. We are incorporating cybersecurity into this strategy by investing in key technology and skillset development to help protect the confidentiality, integrity, and availability of our systems and electronic data. In addition, we are committed to using reasonable efforts, given identified or reasonably anticipated threats, to prevent information security breaches. We have not experienced any such breach in any of the three years shown in the financial statements in this filing or in 2024 through the date hereof, and cybersecurity threat risks have not materially affected our business strategy, results of operations or financial condition. Based on our analysis of the current threat environment, we do not believe that any such material impacts are reasonably likely to occur. See Item 1A of Part I of this Form 10-K for a discussion of risks and uncertainties related to our information systems and technology infrastructure.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We employ a dedicated cybersecurity team. In coordination with our Chief Information Officer, the team assesses and manages cybersecurity threat risks with a focus on identity verification, system access and security, and governance, risk, and compliance. Our Chief Information Officer has extensive information technology and strategic leadership experience, including modernizing and securing business applications and technology stacks. Our director of cybersecurity is a certified information systems security professional with broad experience in cybersecurity, much of which was gained working for the U.S. military. Various members of the cybersecurity team hold industry certifications. The Chief Information Officer regularly shares cybersecurity developments and concerns with the Chief Executive Officer and with other executive officers as concerns arise that impact their areas.


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity and policies and procedures related to the protection of Company proprietary and customer information and compliance with data privacy requirements. The Audit Committee receives quarterly updates from our Chief Information Officer. Reports may address evolving trends in cybersecurity, major threat developments, and technologies, solutions, policies, and procedures we use to detect, prevent, mitigate and remediate threats, respond to incidents and crises, and educate employees on information security importance and requirements. The Audit Committee has regular opportunities to suggest adjustments to the Company's cybersecurity practices. It regularly reports to the Board on fulfillment of its responsibilities, which include cybersecurity risk management oversight.


text: To design and update our cybersecurity strategy, including awareness, prevention, detection, response and recovery components, we strive to align with a respected maturity framework, and we periodically, with the help of a third-party, analyze our alignment. We use a variety of tools to help identify anomalous activity on our systems, including without limitation logs, artificial intelligence, software programs, and data analyses. In addition to internal resources, we use third-party services and software to monitor our cyber environment for detected risks, including without limitation risks from cyber-attackers, employees, and third-parties that we allow to access or contribute to our information technology systems, and to block threats. To assess system vulnerability, we periodically simulate threats, and following such exercises, we assess penetration results and determine and implement remediations.


text: Executive management fosters a cybersecurity threat awareness and risk mitigation culture by supporting regular educational phishing simulations and advocating the importance of cybersecurity in communications to employees. We maintain information security policies to promote employee use of our information technology in a safe manner that helps protect our systems and data from cybersecurity events, and we require periodic enterprise-wide security training and testing and analyze test results.


text: Cybersecurity is integrated with our overall risk management program through cyber coverage as an important component of our insurance portfolio. We maintain cyber insurance to help protect against potential loss or expense arising from a cybersecurity incident or data breach. As part of our cyber insurance renewal, we coordinate with our insurance broker cyber experts to assess our cybersecurity program and align our coverages with our risk management framework. Our oversight processes for reviewing threats from third-parties that we allow to access or contribute to our information technology systems are also important to overall risk management. We subject such third-parties to a variety of cybersecurity analyses, which include our use of risk assessments or scorecards and receipt of third-party audit or other reports related to information security.


text: We have a program for organized response in the event of a cybersecurity incident. Our Chief Information Officer receives alerts disseminated via the program and reports to the Chief Executive Officer as deemed prudent. In the event the incident rises to the level of a crisis, the cyber component of our crisis management plan is triggered. The plan guides a cyber crisis management team, including representatives from our legal, information technology, finance and operations areas, in analyzing the type, scope, cause, impact and other details of the crisis. Our analysis includes without limitation identifying affected systems and exposed data, and in making key decisions to abate, mitigate or respond to the crisis, drawing on pre-identified third-party sources of forensic and other expertise as deemed necessary or advisable. Responsive steps include oversight of any warranted or required communications, including without limitation potential outreach to law enforcement, and informing the Board or Audit Committee of the incident as required by the plan. A final step is for the team to review lessons learned during the incident with the purpose of strengthening future crisis response. The team periodically reviews and practices its protocols to enhance its effectiveness.


text: Under our "Cloud First, Cloud Now" strategy, we prioritize usage of cloud-based technologies to foster innovation, enhance customer service, and meet the demands of the evolving logistics landscape. Cybersecurity is integrated into this strategy through investments in technology and skill development to help protect the confidentiality, integrity, and availability of our systems and electronic data. During the period covered by this Form 10-K and through the date of its filing, we have not experienced, to our knowledge, an information security breach or identified cybersecurity threat risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize that cybersecurity threats are continually evolving, as further addressed in Item 1A of Part I of this Form 10-K.


text: Our dedicated cybersecurity team, in coordination with our Chief Information Officer ("CIO"), assesses and manages risks by focusing on identity verification, system access controls, and governance, risk, and compliance processes. The CIO, with extensive information technology ("IT") and strategic leadership experience, is supported by a director of cybersecurity, a Certified Information Systems Security Professional with significant military cybersecurity expertise, and a team holding various industry certifications and having collective cybersecurity experience of over 75 years. The CIO regularly reports cybersecurity matters to the Chief Executive Officer and executive leadership, for alignment with broader organizational goals.


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity, policies and procedures related to the protection of Company proprietary and customer information, and compliance with data privacy requirements. It receives quarterly updates from our CIO on trends, threats, and technologies used to prevent, detect and respond to risks; reviews and provides feedback on employee education initiatives, crisis response strategies, and remediation measures; and reports to the Board on fulfillment of its cybersecurity risk management oversight.


text: We strive to align with the National Institute of Standards and Technology (NIST) cybersecurity maturity framework and leverage a range of tools, including artificial intelligence, software programs, logs, and data analyses, to detect anomalous activity and identify risks across our systems. Threat simulations, such as penetration testing, are conducted periodically to assess vulnerabilities, analyze results, and implement remediations. Additionally, we employ third-party services for monitoring risks posed by cyber-attackers, employees, and third-party vendors accessing or contributing to our systems. Our oversight of such vendors includes requiring them to undergo cybersecurity analyses through risk assessments, scorecards, and audits.


text: Depending on the services performed, we require certain vendor agreements to contain security and privacy addenda and require vendors to report to us cybersecurity breaches on their systems and/or impacts to our data.


text: We place high importance on conducting tabletop exercises to test and enhance our readiness for cybersecurity incidents. These exercises involve our Crisis Management Team, which includes representatives from executive management, legal, information technology, finance, operations, and marketing. The Crisis Management Team focuses on analyzing the scope, impact, and root cause of simulated incidents, while the marketing and legal departments, along with a team of executives, plan the messaging to customers, employees and other stakeholders deemed necessary or advisable in the circumstances. For compliance readiness, we monitor the legal and regulatory landscape associated with cybersecurity incidents. These exercises and activities provide valuable insights to improve transparency, messaging, response protocols, stakeholder confidence and organizational resilience in the event of a cyber crisis.


text: To manage material risks and enhance preparedness, we maintain a cyber insurance program integrated into our overall risk management framework. During insurance renewals, we collaborate with brokers and cyber experts to assess our program and align coverages with identified risks. In the event of a cybersecurity incident, our crisis management plan is triggered, mobilizing the Crisis Management Team to assess the situation and oversee critical decisions related to abatement, mitigation, and response. Responsive steps, each as deemed necessary or advisable and in addition to other elements of the plan, include engaging third-party forensic and other experts, coordinating communications with stakeholders, contacting law enforcement, and reporting incidents to the Board or Audit Committee. In a post-incident review, lessons learned are analyzed for incorporation into future protocols.


text: We foster a culture of cybersecurity awareness through regular phishing simulations, enterprise-wide security training, employee education on safe technology practices, and information security policies. We continue to evaluate cybersecurity risks and enhance our strategy to safeguard our operations and data as part of our commitment to operational resilience and innovation.


text: Risk Management and Strategy The Company has implemented policies and procedures that are intended to manage and reduce cybersecurity risks. Material risks from cybersecurity threats are managed across HDMC, HDFS, LiveWire and third-party suppliers and vendors. Cybersecurity risks and threats are monitored by the Company's Corporate Information Security Office and routinely discussed with senior management across the Company. Cybersecurity risks are identified and assessed through third-party assessments, IT security assessments, audits conducted by Internal Audit and risk and compliance reviews. Additionally, as part of the Company's cybersecurity risk management process, tabletop exercises are conducted at the technical and management levels. During these tabletop exercises, cybersecurity incidents are simulated, aimed at ensuring the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cybersecurity program.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The Company takes measures to regularly update and continuously improve its cybersecurity program, including conducting independent program assessments, performing penetration testing and scanning the Company's systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies and monitoring emerging laws and regulations related to information security. The Company also periodically engages third-party consultants to assist in assessing and enhancing its cybersecurity program. The Company has implemented risk-based controls to protect its information, customer information, third-party information, its information systems and its business operations. The Company follows the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has adopted security-control principles based on NIST, other industry-recognized standards and contractual requirements, as required.


text: With respect to third parties, the Company's cybersecurity program includes a cybersecurity supply chain risk management component aimed at identifying and mitigating risks from vendors, suppliers, and other third-parties. The supply chain risk management program is integrated into the Company's procurement workflow and includes conducting due diligence on select suppliers, vendors and other third parties. The cybersecurity risks of the vendor, supplier or other third party are evaluated by the Corporate Information Security Office when assessing the engagement and determining the appropriate oversight of the vendor, supplier or other third party. The Company also contractually requires suppliers, vendors and other third parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law. To oversee the risks associated with these service providers, the Company works with suppliers, vendors and other third parties to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of the Company's systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect the Company.


text: The Company's cybersecurity program also includes a cybersecurity training component. All employees are required to complete annual cybersecurity training focused on helping the workforce recognize cyber threats and scams, avoid falling victim to threats and scams, and report potential threats and scams. In addition, periodic cybersecurity awareness messages are posted on the Company portal.


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. For additional information, refer to "A significant cybersecurity incident or data privacy breach may adversely affect the Company's reputation, revenue and earnings," in Item 1A. Risk Factors.


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's information security and technology risks, including cybersecurity. On December 15, 2023, the CISO announced his retirement from the Company, and since that time, our Chief Digital and Operations Officer is serving as our acting CISO, executing all of the responsibilities of the CISO, while the Company conducts a search to fill the position. The Company's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: At the management level, the Company has established an incident review committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Vice President of Communications and Corporate Relations, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security and Privacy Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's data privacy function and information security and technology risks, including cybersecurity. The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over 10 of those years. The CISO reports to our Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: At the management level, the Company has established a Cyber Incident Review Committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Chief Communications Officer, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.

companyName: Level 3 Parent, LLC


text: The Cyber Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the General Data Protections Regulations ("GDPR"), as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Our Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: Our Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including oversight by Lumen's Board of Directors, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board of Directors to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen's cybersecurity organization includes a response team and management-level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board of Directors and senior leadership team. Some of the more significant risks discussed by the ROC are also reported to Lumen's Security Committee at least quarterly.


text: Risk Management and Strategy Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework (NIST-CSF), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; and (v) managing third-party risks. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: Under the oversight of the Chief Information Officer (CIO), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.


text: To ensure the effectiveness of our existing cybersecurity controls and processes, and identify areas for improvement based on the latest industry best practices, we regularly engage third-party consulting services to conduct independent audits and assessments. Additionally, we leverage external expertise to evaluate our cybersecurity and risk management strategy, review policies and procedures to address emerging risks, and maintain ongoing compliance with evolving legal and regulatory requirements.


text: Security Controls: Our approach to cybersecurity employs a multi-layered strategy, implementing a range of technical administrative and physical controls to safeguard critical systems and data. These controls encompass (i) firewalls, intrusion detection, and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activities, and protect network infrastructure; (ii) encryption, including secure protocols and multi-factor authentication, to secure information in transit and at rest; and (iii) a secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to mitigate emerging cyber threats proactively.


text: Incident Response: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board of Directors (the "Board") cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.


text: Employee Awareness and Training: Our employees play a pivotal role in maintaining a strong cybersecurity posture. Our Information Security Policy Framework outlines the requirements for employee conduct concerning company information and company-managed devices, encompassing relevant privacy, data security, and data retention policies. We believe our Information Security Policy Framework aligns with industry best practices and applicable legal and regulatory requirements. Complementing our Information Security Policy Framework, we conduct regular cybersecurity training campaigns that emphasize the importance of cybersecurity awareness. These campaigns address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness, and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness and testing exercises.


text: Third-Party Risk Management: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we have implemented a comprehensive third-party risk management program designed to identify and oversee such risks. This program relies on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.


text: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CIO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.


text: While our Board and Audit Committee oversees cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board semi-annually on our enterprise risk management processes, ensuring transparency and accountability.


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CIO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Senior Director of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. The Cybersecurity Steering Committee meets and receives bi-monthly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.


text: Through this robust governance structure, involving Board oversight, senior management leadership, and a cross-functional committee, we maintain a proactive and comprehensive approach to managing cybersecurity risks across the organization.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors.


text: Risk Management and Strategy Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST-CSF"), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; (v) managing third-party risks; and (vi) providing governance aligning with business objectives and ensuring senior leadership accountability for cyber security risk management. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: Under the oversight of the Vice President of Information Security who operates as our Chief Information Security Officer ("CISO"), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.


text: Incident Response: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from internal cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.


text: Third-Party Risk Management: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we are implementing a comprehensive third-party risk management program designed to identify and oversee such risks. This program will rely on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We will utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.


text: Governance: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CISO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board annually on our enterprise risk management processes, ensuring transparency and accountability.


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CISO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Vice President of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. Our CISO has over 25 years of cybersecurity and corporate risk management experience. The Cybersecurity Steering Committee meets and receives quarterly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. "Risk Factors".


text: Risk Management and Strategy. We have policies and procedures for identifying, assessing and managing material risks associated with cybersecurity threats. To help protect our IT resources, we have instituted administrative, physical and technical controls and processes and commissioned third-party assessments. The technical defense measures we have implemented are designed to address vulnerabilities that may arise, including from a security control failure. These measures currently involve a combination of artificial intelligence; machine learning computer network monitoring; malware and antivirus resources; firewall systems; endpoint detection and response; cloud service defenses; Internet address and content filtering monitoring software intended to secure against known malicious websites and potential data exfiltration; and a variety of cyber intelligence and threat monitoring sources, which provide ongoing updates, all provided by third parties that we believe are capable of performing the service for which they have been engaged or governmental agencies. When engaging a third party for these types of services and resources, we typically conduct a security review involving, as relevant to the service or resource, discussions with the firm's security personnel, evaluation of auditor reports, and other requested information and documentation.

companyName: KB HOME

ticker: KBH


text: We evaluate, and adjust as determined appropriate, our cybersecurity strategies and measures based on the above-noted threat monitoring sources, learnings from periodic incident response tabletop exercises in which members of senior management participate; penetration tests and scanning exercises; and an annual cybersecurity and/or cloud security risk assessment conducted with help from outside experts informed by the National Institute of Standards and Technology Cybersecurity framework. Our IT function also undertakes a specific risk review, assisted in part by independent consultants and other third parties, that is integrated into the overall annual enterprise risk management assessment the board of directors' audit and compliance committee oversees. Our internal audit department incorporates the results from this risk review, and cybersecurity-related enhancements identified through the review, in designing and conducting its IT function audits, in some cases with a third-party firm's assistance.


text: To support the ongoing identification and management of cybersecurity issues, all employees are required to complete cybersecurity awareness training, including social engineering, password best practices, data classification and phishing awareness, with additional training for handling of customer personal information. We also publish a monthly security awareness newsletter along with performing ongoing internal phishing assessments.


text: We also consider and evaluate cybersecurity risks associated with KBHS and third-party service providers that we have identified as having the greatest potential to expose us to cybersecurity threats. We have established due diligence procedures with KBHS and such third-party service providers, as well as communication channels as part of their breach and incident response processes. We also review annually the System and Organization Controls reports of third-party vendors hosting our data to ensure they maintain adequate access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures and periodic independent testing of the vendor capabilities. We depend on our third-party service providers, KBHS and outside service providers to our customers with whom we share some personal identifying and confidential information to secure the information they receive from us.


text: Our business strategy, results of operations, or financial condition may be materially affected if our IT resources are compromised, whether by an intentional attack, natural or man-made disaster, electricity blackout, IT/cybersecurity failure, systems misconfiguration, denial-of-service attacks, service provider error, mismanaged user access protocols, personnel action, or otherwise, as we may be severely limited in conducting operations for an extended period, experience internal control failures, be cut off from assets or funds, face reputational damage, lose customers and related revenues and/or have private party or governmental legal proceedings instituted against us, and incur significant expenses to resolve any such issues. Similar impacts may result from a substantial disruption, or security incident or breach KBHS or an outside service provider to our customers suffers, which could also result in sensitive personal information being publicly disclosed or misused.


text: Governance. Our management is responsible for the ongoing assessment of, and for developing and implementing our strategies and measures to address, material cybersecurity risks. Our board of directors through its audit and compliance committee oversees management's cybersecurity assessment activities and protective strategies and measures. This includes engaging in periodic reviews with management covering, among other things, our cybersecurity practices and risks. Our chief information officer ("CIO") periodically provides this review to the audit and compliance committee, with the most recent review conducted in January 2025. The CIO, who has more than 34 years of experience in IT and cybersecurity, is supported by a chief information security officer and various employees and dedicated contract personnel experienced with IT and cybersecurity matters who are responsible for procuring, using, maintaining, updating and evaluating the cybersecurity measures detailed above. These individuals also hold numerous cloud, security and privacy certifications.


text: Our IT function, which is led by the CIO, maintains and is initially responsible for executing on a cybersecurity incident response plan and specific runbooks, which describe processes for evaluating and escalating, depending on severity, within the enterprise and up to our senior executive management and board of directors the cybersecurity threats and incidents, or potential threats or incidents, identified through our cybersecurity measures, as well as making public disclosures thereof. This team also maintains other policies and procedures concerning cybersecurity matters, such as encryption standards, antivirus protection, remote access, multifactor authentication, data classification, confidential information and the use of the internet, social media, email and wireless devices. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio.


text: Our IT systems have faced a variety of phishing, denial-of-service and other attacks. Although we have not identified any cybersecurity incidents during the fiscal years covered by this report that have materially affected or are reasonably likely to materially affect our business strategy, consolidated results of operations or consolidated financial condition, we can provide no assurance that our security measures will be successful and therefore we may experience a cybersecurity incident that materially affects our business strategy, consolidated results of operations, consolidated financial condition or reputation, including, but not limited to those described above. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors.


text: Risk Management and Strategy Adobe has certain security processes, infrastructure, systems, policies and practices for assessing, identifying and managing risks from cybersecurity threats. We maintain an information security risk management framework for managing cybersecurity risks, priorities and projects for our products, services, infrastructure and corporate resources. As part of our framework, a cybersecurity risk steering committee meets regularly to review newly identified risks and progress on remediating existing risks.

companyName: ADOBE INC.

ticker: ADBE


text: We conduct regular security reviews, simulations and testing, including internal and external penetration testing, vulnerability assessments and regular scans on our hosts and network devices. We review available threat intelligence, including information from industry groups and our security vendor. We consult with third parties, including cybersecurity consultants, as part of our cybersecurity threat and risk management strategy.


text: Depending on the environment, our risk mitigation strategies include a variety of technical, physical and operational measures designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We require employees annually to complete a general security awareness training, and additional engineering and security specific training may also be required for certain positions. Further, we maintain a vendor security review program, which is designed to provide an assessment of the security practices of those third-party vendors that process Adobe non-public data or connect to our networks. We maintain an information security incident response plan designed to monitor, analyze, address, escalate and report cybersecurity incidents, and escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Security Officer ("CSO"), Chief Cybersecurity Legal and Privacy Officer ("CCPO"), Chief Financial Officer, Chief People Officer, President of Digital Media, President of Digital Experience, General Counsel and Chief Executive Officer.


text: For a description of the risks from cybersecurity threats that may materially affect us, see the risks described in the section titled "Risk Factors" contained in Part I, Item IA of this report, including under the headings "Security incidents, improper access to or disclosure of our customers' data or other cybersecurity incidents may harm our reputation and materially and adversely affect our business."


text: Our Board of Directors (the "Board") addresses cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") has oversight of enterprise risks, including risks related to cybersecurity. In this regard, the Audit Committee reviews and discusses with management the adequacy and effectiveness of our information security, technology and privacy policies and the internal controls regarding these areas. Our Audit Committee receives regular cybersecurity updates about general cybersecurity risks from our CSO and updates about the prevention, detection, mitigation and remediation of cybersecurity incidents from our CSO and CCPO. Cybersecurity updates presented to the Audit Committee are reported to the Board by the Audit Committee Chair. We also have a Cyber Disclosure Committee, comprised of cross-functional leaders including finance, risk, operations and investor relations and led by the CSO and CCPO, that meets to assess certain incidents and makes determinations regarding materiality. Additionally, our CSO and CCPO identify certain cybersecurity risks that are reviewed as part of the enterprise risk management framework and presented to the Board and the Audit Committee on an annual basis.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including our CSO and CCPO, whom each has extensive cybersecurity experience in their respective areas of responsibility and expertise. Our CSO, who reports to the Chief Financial Officer, has primary responsibility for hiring appropriate information security personnel and managing workloads of information security personnel, engaging and overseeing third-party cybersecurity consultants, approving budgets and cybersecurity processes, preparing for incident response, reviewing security assessments and other security-related reports, communicating key priorities to relevant personnel, including the security incident response team, assessing and managing Adobe's overall cybersecurity strategy, standards, risk management (in consultation with the cybersecurity risk steering committee) and processes. Our CCPO, who reports to the General Counsel, has primary responsibility for the legal aspects of the cybersecurity program, including assessing and providing advice on our cybersecurity strategy, standards, risk management, policies, processes and legal obligations. Our CSO and CCPO are supported by a cybersecurity team comprised of cybersecurity, information security, information technology, operations and legal executives and professionals.


text: RISK MANAGEMENT AND STRATEGY Occidental has implemented and maintains processes for assessing, identifying and managing material risks from potential unauthorized occurrences on or through its IT and ICS networks that may result in material adverse effects on the confidentiality, integrity and availability of Occidental's systems and the information residing in those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting Occidental's systems and the data it collects, processes, stores and transmits as part of its businesses.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Occidental has developed a robust cybersecurity program which is reviewed by senior leadership including its Chief Information Officer (CIO) and other stakeholders as part of its standard general IT controls. Business network and ICS cybersecurity risks are handled by separate and dedicated Occidental teams and are incorporated into Occidental's enterprise risk management program.


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. The Company conducts internal security audits, including audits conducted by third parties, and other assessments. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.


text: Occidental has implemented and maintains a cybersecurity incident response plan that provides the organizational and operational protocol for the Company to effectively and timely respond to cybersecurity incidents. In the event of a material cybersecurity incident, Occidental's CIO will receive regular updates and monitor detection, mitigation and remediation through reports from a team of experienced cybersecurity leaders responsible for actioning the Company's cybersecurity incident response plan. As a material cybersecurity incident is handled by the team, the CIO will maintain communication and information flow to senior leadership as well as the Audit Committee and/or the Board, as appropriate.


text: Cybersecurity risks and associated mitigation strategies and efforts are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board. Additional information on cybersecurity risks Occidental faces is discussed in Item 1A of Part I, "Risk Factors," under the heading "Occidental is exposed to cyber-related risks," which should be read in conjunction with the foregoing information.


text: Occidental's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but Occidental cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on Occidental's cybersecurity related risks, see Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board oversees the Company's IT security programs, including cybersecurity, which includes review of possible external threats and potential mitigations. The Board also reviews the Company's cybersecurity program at least annually. In this review, the CIO briefs the full Board on cybersecurity and data protection matters, including analysis and review of the measures implemented by the Company to identify and mitigate cybersecurity risks. Occidental also has protocols by which material cybersecurity incidents are to be reported to the Audit Committee and/or the Board, as appropriate.


text: Occidental's CIO, who has over 20 years of IT and cybersecurity experience at the Company and elsewhere, heads the team responsible for implementing and maintaining cybersecurity and data protection practices across Occidental's businesses and reports directly to the President and CEO. Occidental has a centrally coordinated team, led by its CIO, responsible for implementing and maintaining cybersecurity and data protection practices across the Company. Occidental's CIO regularly reviews risk management measures and the overall cyber risk strategy implemented and maintained by the Company. The CIO receives regular updates on Occidental's cybersecurity program and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through reports from the Company's cybersecurity leaders, each of whom is supported by a team of trained cybersecurity professionals. In addition to Occidental's extensive in-house cybersecurity capabilities, Occidental also engages assessors, consultants, auditors or other third parties when necessary to assist with assessing, identifying and managing cybersecurity risks.


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. Occidental has invested in broad cybersecurity awareness and mandatory training to educate those with access to company networks on Occidental's cybersecurity policies and best practices. Occidental conducts regular phishing tests to educate, train and assess the workforce's ability to identify malicious emails. The Company also conducts internal security audits and other readiness tests, including audits conducted by third parties and tabletop exercises, to assess and improve preparedness and promote communication and monitoring across the organization. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.