text: Our Manager's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Manager's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for existing third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR

secItem: Item 1C


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Board and Management's Role and Expertise and Oversight of Risk Management and Strategy Our information technology ("IT") department, which maintains our cybersecurity function, is led by our SVP, Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer, and has over 25 years of broad IT and digital transformation experience leading large technology organizations and product teams with expertise in IT organizational leadership, network and cloud infrastructure, and enterprise engineering and technology. Our VP, Chief Information Security Officer ("CISO") reports directly to the CIO, and is responsible for managing our risks from cybersecurity threats, protecting and defending our networks and systems, and overseeing our Information Security Office. Our CISO has over 20 years of experience leading cybersecurity and information security departments and manages a team of professionals who have broad industry experience and expertise, including disaster recovery, IT risk management, detection and mitigation technologies, incident response, threat management, and regulatory compliance, and who hold industry recognized certifications, such as the Certified Information Systems Security Professional and Certified Risk and Information Systems Control.


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders throughout the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board as needed. For instance, during the December 2022 cybersecurity incident, our Board and Audit Committee were regularly updated, and our Audit Committee provided oversight and feedback with respect to management's investigation of, and response thereto, including internal and third-party investigations, public or governmental disclosures and our remediation efforts.


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, and which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and internal audit as well as our CISO, provides additional support for enterprise risk management assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment and monitoring, vulnerability scans, end-point detection and response and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service, our overall cybersecurity risk management program leverages the ISO 27001 framework. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.


text: Employees are required to complete a cybersecurity training at least once a year specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by the Written Information Security Program (WISP) framework, other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the U.S. and U.K. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 framework.


text: Third parties also play a role in our cybersecurity risk management and strategy. We contract with a third-party cybersecurity incident response team to assist in the management of cybersecurity threats. We also engage and rely on third-party cyber and information security providers for cybersecurity applications and infrastructure to protect our network, systems and data.


text: Incident Response and Reporting In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, and notifications process, internally and externally. Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee Chair and the full Board.


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide a SOC 1 or SOC 2 report and, for vendors unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: Impact of Cyber Risk on our Business We face a number of cybersecurity risks in connection with our business. We continue to invest in the security and strength of our networks and to enhance our internal controls and processes, which are designed to help protect our systems, infrastructure, and data. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the December 2022 cybersecurity incident, have not materially affected our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, "Risk Factors."


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats and information security.


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders across the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, and Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, the results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board periodically.


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and Internal Audit as well as our CISO, provides additional support for ERM assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment, monitoring through logging and correlation, vulnerability scans, cyber threat intelligence, end-point detection and response (EDR), and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service line, our overall cybersecurity management program is based on the ISO 27001 standard. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.


text: Employees are required to complete a cybersecurity training annually specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by our Written Information Security Program (WISP), other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the United States and United Kingdom. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 standard.


text: Incident Response and Reporting In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, escalation and notifications process, both internally and externally. Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee and the full Board.


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity and disaster recovery preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide an independent information security audit report and, for vendors unable to provide such audit reports, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: Risk Management and Strategy The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third -party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third -party service provider or that otherwise impacts third -party technology and systems we use.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Internal Cybersecurity Team The Company's internal information security organization (Internal Cybersecurity Team), led by our Executive Vice President and Chief Information Officer (CIO) as well as the Assistant Vice President and Chief Information Security Officer (CISO), is responsible for coordinating all aspects of the Company's electronic information security systems, including prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as implementing, monitoring, and maintaining our enterprise-wide security strategy, standards, architecture, policies, and processes. Our CIO reports directly to our Chief Executive Officer, our CISO reports to our CIO, and reporting to our CISO are our Deputy Chief Information Security Officer (Deputy CISO) and other experienced information security personnel responsible for various parts of our business. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. When the Company learns of a cybersecurity incident at a third -party service provider, the Company's respective department contacts maintain communication with the third -party service provider and communicate any cybersecurity incidents to the CISO.


text: The Internal Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment, prioritization, and remediation program. The Internal Cybersecurity Team also performs regular system penetration testing to validate our security controls and assess our infrastructure and applications. All management employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, in 2023, our Board of Directors and certain management employees participated in a tabletop exercise to simulate a response to a cybersecurity incident, and our Internal Cybersecurity Team incorporated the findings from this exercise into our processes.


text: We also rely on information technology and third -party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all of the information systems we use. Incidents may lead to reputational harm, revenue and client loss, legal actions, or statutory penalties, among other consequences. For a more detailed discussion of these risks, see our discussion in the Risk Factors in Item 1A of this report.


text: The Board of Directors has delegated primary oversight of the Company's cybersecurity risk to the Audit Committee, which receives updates on cybersecurity risks and incidents at each regularly scheduled Audit Committee meeting from the CIO, CISO, and other members of management, as needed. When making decisions regarding director appointments and committee assignments, the Board of Directors takes into consideration the cybersecurity experience of directors and director candidates and strives to maintain cybersecurity expertise on the Board of Directors and Audit Committee. We have protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board of Directors.


text: At the management level, our CIO, CISO, and Deputy CISO, each of whom has extensive cybersecurity knowledge and skills gained from over 27 years, 28 years, and 19 years of relevant work experience, respectively, head the Internal Cybersecurity Team that is responsible for implementing and maintaining cybersecurity and data protection practices across our business, with our CIO reporting directly to our Chief Executive Officer. In 2023, our CIO was appointed to serve as a member of the U.S. Cybersecurity Advisory Committee (CSAC) of the Cybersecurity and Infrastructure Security Agency (CISA), which provides recommendations to CISA on a range of cybersecurity issues, including corporate cyber responsibility, technology product safety, and efforts to raise the baseline of cybersecurity practices for a variety of entities to enhance the United States' cyber defense. Our CISO and Deputy CISO receive reports on cybersecurity threats from a number of experienced information security professionals for various parts of our business on an ongoing basis and, in conjunction with other management personnel, regularly consult on risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: In addition, our Risk and Compliance Committee (RCC) is responsible for oversight and support of the Company's Enterprise Risk Management and Compliance and Ethics programs and is comprised of the Executive Leadership Team and the Senior Vice President and Chief Accounting, Risk, and Compliance Officer (Compliance Officer). The RCC also created a subcommittee, the Enterprise Risk Management Committee (ERMC), who is charged with continually monitoring, evaluating, and managing enterprise risks. The ERMC includes the Compliance Officer, General Auditor, Vice President Law - Finance and Compliance, Vice President and Chief Safety Officer, CISO, and Assistant Vice President - Corporate Strategy. The RCC and ERMC both meet throughout the year and receive periodic updates on cybersecurity from the CISO and Deputy CISO.


text: Cybersecurity Risk Management We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information.

companyName: CORNING INC /NY

ticker: GLW


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan ("CIRP"). Corning's CIRP provides the Company with the capability for responding, reporting and remediating cybersecurity incidents. It has been established to reduce or minimize the impact of cybersecurity incidents on the Company's networks, IT systems, users or business processes. Corning's Cyber Security Incident Response Team, led by the Chief Information Security Officer ("CISO"), handles the response process for all cybersecurity incidents and Corning's Corporate Crisis Response Team ("CCRT") is mobilized and involved in any significant incidents.


text: Our cybersecurity risk management program also includes: a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information and broader enterprise IT environment;


text: the use of reputable cybersecurity consultants and other third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so the Company can maintain a posture of continual enhancement of our cybersecurity management and strategy;


text: cybersecurity awareness training for our employees, incident response personnel and senior management; and a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.


text: Cybersecurity Governance Corning's Board of Directors ("Board") plays a role in overseeing risks associated with cybersecurity threats. In particular, the IT Committee of the Board is responsible for cybersecurity governance and has information security oversight as a key component of its charter. In all meetings, the IT Committee reviews the Company's cybersecurity posture as well as significant cybersecurity events. Corning's Chief Digital and Information Officer ("CDIO"), in combination with Corning's CISO, briefs the IT Committee on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. On an annual basis, the CISO provides a cybersecurity update to the Board and participates in a joint meeting of the IT and Audit Committees to review significant cybersecurity risks and their impact, if any, on internal controls. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures. Should a cybersecurity incident rise to the level of a corporate crisis, consistent with the Company's CCRT escalation protocols, the Board would be engaged.


text: Our CDIO and our CISO lead our management team in assessing and managing our response to cybersecurity threats and incidents. Our CDIO and CISO together have over 50 years of combined experience in information technology, digital and systems transformation, cybersecurity and related risk management and governance. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and works with all divisional, manufacturing and functional teams within Corning on cybersecurity issues. The team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment.


text: While Corning has had to address various cybersecurity threats in the ordinary course of its business, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management process is a component of our overall enterprise risk management process, through which our Chief Executive Officer and other members of senior management assess, identify, and manage material risks from cybersecurity threats we face. Our cybersecurity process seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. The Board of Directors (the "Board"), and the Audit Committee of the Board (the "Audit Committee"), provide oversight of our cybersecurity risk management process. The Audit Committee reviews our cybersecurity program and cybersecurity risk management process quarterly, and our Board reviews our cybersecurity program annually. Our cybersecurity program is directly managed by the Chief Information Officer ("CIO"), who is experienced in information systems and cybersecurity and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic updates to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management. These updates cover the Company's material cybersecurity threats, the status of projects to strengthen our cybersecurity posture, and assessments of the cybersecurity program. Our cybersecurity risk management process is evaluated by internal and external cybersecurity experts, and the material results of those reviews are reported to senior management and the Board and Audit Committee as part of their oversight role. We also engage with third-party service providers deemed to have subject matter expertise in cybersecurity matters, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and processes. We require each third-party service provider to certify that they implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us. We use various tools and methodologies to manage cybersecurity risk and to prevent, detect, and mitigate cybersecurity incidents. Our tools and methodologies are tested regularly, including vulnerability scans, red-teaming exercises and other penetration testing, and review of cybersecurity threat intelligence feeds. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Factors Related to Overall Business & Operations – Our business depends on the use of information technology systems. A failure of these systems, cybersecurity incidents, or cyber-fraud may cause business disruptions, compromise our intellectual property or other sensitive information, or result in losses."

companyName: LATTICE SEMICONDUCTOR CORP

ticker: LSCC


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our intellectual property and data. We maintain policies and procedures designed to allow management to assess, identify, and manage material risks from cybersecurity threats. We integrate our cybersecurity policies and procedures into our overall enterprise risk management program, which is implemented by management and overseen by the Board of Directors through its Audit Committee.

companyName: COHU INC

ticker: COHU


text: We utilize the Center for Internet Security ("CIS") Critical Security Controls as a framework for managing our cybersecurity program. The CIS framework outlines 18 critical control areas relating to organizational security and provides effective methodologies, guidelines, and industry standard best practices to develop and manage a comprehensive cybersecurity program. Additionally, we align our controls to various international security certifications and standards and have adopted best practices from industry leading frameworks. Our cybersecurity program includes policies and procedures relating to encryption, data loss prevention technology, authentication technology, access control, anti-malware software, third-party risk monitoring, insider risk management and identity management. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also regularly obtain system and organization control ("SOC") reports from our service providers ("SOC 2"). Members of our corporate information security organization receive information exchanges from their professional networks and attend training, webinars, and conferences to stay up to date on both trends and system-specific updates. In addition, all Cohu employees are required to complete regular security awareness training including testing, each of which are designed to promote a company-wide culture of cybersecurity risk awareness and management.


text: As part of the Board of Directors' role in overseeing our enterprise risk management program, which includes our cybersecurity risk management, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to have an adverse effect on us. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee conducts reviews of the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and in aligning cybersecurity efforts with the overall risk management framework and promotion of our business objective and operational needs. In addition to our scheduled meetings, the Audit Committee maintains an ongoing dialogue with management, including emerging or potential cybersecurity risks.


text: Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CISO has over 35 years of experience in various roles in information technology and information security, including serving as SVP and CIO or VP and CIO at various defense, aerospace and semiconductor supplier companies. He holds a bachelor's degree in Computer Science, an MBA, and holds several relevant certifications, including ITIL Certification. The corporate information security organization manages and regularly enhances our enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our cybersecurity incident response team ("CIRT"), which is responsible for the protection, detection and response capabilities used in the defense of Cohu's data and enterprise computing networks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, mitigation or eradication, recovery and notification, including notifying key functional areas, as well as the CEO, Chairperson and Chairperson of the Audit Committee and other members of the Board, as appropriate.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations or financial condition. Notwithstanding the measures we take to assess, identify, and manage cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a discussion of how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, see the risk factor entitled " Our business and operations could suffer in the event of cybersecurity breaches within our operational systems or products ".


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: As of December 31, 2023, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2023, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: BlackRock's Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.

companyName: iShares Gold Trust Micro

ticker: IAUM


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub committee of the firmwide Enterprise Risk Committee ("ERC").

companyName: iShares Silver Trust

ticker: SLV


text: Cross-Functional Approach: BlackRock has implemented a global, cross functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Dana maintains a risk management program overseen by our Executive Leadership Team. Our Senior Vice President and Chief Financial Officer and Senior Vice President, General Counsel and Secretary / Chief Compliance and Sustainability Officer (General Counsel) have responsibility for our risk management program. In addition, our Business Unit Presidents and functional leads oversee strategic and operational risks, including cybersecurity risks. Cybersecurity is a top priority, and our cybersecurity program is driven by our commitment to maintaining a strong security architecture, active governance, and robust controls. Our cybersecurity program is led by our Director of Cybersecurity and GRC (DOC) and overseen by Dana's Enterprise Cybersecurity Steering Committee (ECSC). The ECSC is sponsored by senior leaders from disciplines such as Information Technology, Legal, Human Resources, Engineering, Product Development, and Operations, and includes the Senior Vice President and Chief Information Officer (CIO); General Counsel; Senior Vice President and Chief Human Resources Officer; Senior Vice President and Chief Technology Officer; and Senior Vice President Global Operations. The ECSC is responsible for developing and overseeing strategies related to Dana's cybersecurity program. As set forth in its charter, our Technology & Sustainability Committee, comprised of independent directors, has oversight responsibilities for cybersecurity risk and includes members with significant cybersecurity experience. The DOC and CIO regularly provide updates on Dana's cybersecurity program to the Board and the Technology & Sustainability Committee.

companyName: DANA Inc

ticker: DAN


text: Dana's global cybersecurity team is charged with executing enterprise, product, and manufacturing cybersecurity programs and policies with a focus on security architecture, penetration testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training, and governance. Dana's cybersecurity programs utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverage the International Organization for Standardization (ISO) 27001 standard for information security. Dana periodically contracts with external auditing firms to assess the maturity of Dana's cybersecurity program against the NIST Cybersecurity Framework. The results of these audits are shared with the Technology & Sustainability Committee. Dana leverages independent security ratings services assessments to aid in measuring our progress along the cybersecurity continuum as well as for measurement against peer companies. Dana's supplier risk management process incorporates cybersecurity review and assessment procedures over third-party vendors and service providers.


text: Dana has an established cybersecurity awareness training program. Formal training on topics relating to cybersecurity is mandatory at least annually for all employees with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Training is supplemented by phishing awareness campaigns.


text: In the event a high-risk cybersecurity incident is identified, our Incident Response Team will coordinate the response in accordance with our Information Security Incident Response Plan and make necessary communications to the ECSC and executive leadership. The DOC and CIO will make any required communications to the Chief Executive Officer (CEO), with the CEO making any required communications to the Board and Technology & Sustainability Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: In the last three years we have not experienced any cybersecurity incident that has been material to the results of our operations or that has caused us to incur any material expenses.


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program and evaluated against such Framework. Our information security and ERM teams coordinate to regularly review and assess these risks using a wide range of tools and services.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our cybersecurity risk is actively managed through our Cybersecurity Steering Committee, which has established Company-wide policies and standards concerning cybersecurity matters. These policies directly or indirectly relate to cybersecurity and include antivirus protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and regularly reports on cybersecurity matters to executive management and the Board of Directors. The CISO has over 25 years of experience supporting cybersecurity and information technology and is a board member of a local Cyber Threat Response Alliance organization. Led by our CISO, team members who support our information security program have relevant educational and industry experience.


text: The CISO and information technology security team conduct regular risk assessments to identify areas requiring additional investment and resources. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software and we periodically engage third-party services for penetration testing and security evaluations. We also periodically assess our technology infrastructure and business processes to identify and address potential security gaps and vulnerabilities. An ISO 27001 certification is maintained within our Energy Services business.


text: As chair of the Cybersecurity Steering Committee, the CISO holds regular meetings to provide strategic updates on the Company's cybersecurity infrastructure and preparedness. These meetings, supplemented by regular updates to the Board of Directors, are instrumental in aligning with the Company's strategic goals. Our Board of Directors is also provided with ongoing education including updates on relevant legislation and regularly receives reports on cybersecurity risks, threats, incidents and other trends. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.


text: In order to promote a culture of security awareness across our organization, all employees are required to complete an annual cybersecurity awareness training and are provided with periodic information updates on cybersecurity threats. We also maintain cyber insurance policies to help partially mitigate the financial impact of a significant cybersecurity incident.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to invest in our security controls, incident response capabilities, and third-party vendor management protocols. For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors".


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: These processes are managed and monitored by a dedicated Cybersecurity and Infrastructure team, which is led by our Chief Information Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and annual and ongoing risk assessments. We engage third parties to perform monitoring and regular penetration testing. We have adopted an Incident Response Policy that applies in the event of a cybersecurity threat or incident that follows the National Institute of Standards and Technology framework. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Information Officer who reports to the Chief Financial Officer and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Nominating and Governance Committee has been designated by our Board to oversee cybersecurity risks. The Nominating and Governance Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures from our Chief Information Officer. The Board also receives updates from management and the ESG Committee on cybersecurity risks on at least an annual basis.


text: We rely on information technology systems across our operations, including for management, supply chain and financial information and various other processes and transactions. Our ability to effectively manage our business depends on the security, reliability and capacity of these systems. We have established a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. We have implemented additional controls, security processes and monitoring of our manufacturing systems. We have also implemented additional cloud security tools and governance processes for assessing, identifying and managing material risks from cybersecurity threats. In addition, we maintain an information security training program that encompasses the following areas: phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: SHYFT GROUP, INC.


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Continuing oversight of our cybersecurity risk is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. In turn, our Chief Information Officer provides key updates on risk and mitigation strategies to the Audit Committee.


text: We rely on third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses, and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our internal assessment results and to stay informed of information security risks. Additionally, we maintain a supplier validation process, which involves approval by our cybersecurity group for significant suppliers that will have access to any of our databases or technology. We also maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected, or reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our Chief Information Officer ("CIO"). The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has over 20 years of global automotive technology and cybersecurity experience and reports to our President and Chief Executive Officer.


text: The Company's Security Manager reports to our CIO and is the head of our cybersecurity team. The Security Manager is responsible for assessing and managing our cyber risk management program, informs senior management, together with the CIO, regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Security Manager has over 15 years of experience in technology and cybersecurity, a master's degree in information security and industry certifications, including CISSP, CDPSE, ITIL, and COBIT.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems, shield our operational technologies in our manufacturing plants and protect the confidentiality, integrity and availability of our data.

companyName: HUNTSMAN INTERNATIONAL LLC


text: We have a qualitative cybersecurity risk management program within our Enterprise Information Security function to promote a company-wide culture of cybersecurity risk management for our information technology and operational technology. This program supports cybersecurity considerations as part of our decision-making processes. Our Enterprise Information Security team works closely with our global information technology organization ("Global IT"), operational technology teams and business units to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We are aligned with the U.S. National Institute of Standards and Technology Cybersecurity Framework, against which we periodically assess our readiness.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity posture. These partnerships enable us to leverage specialized knowledge and insights in the development of our cybersecurity program consistent with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Because we are aware of the risks associated with third parties, we have implemented a third-party security risk management program to oversee and manage these risks. We conduct security assessments of third-party providers contracted by Global IT before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The program includes tools and services, which continuously monitor third parties for potential security concerns, data leaks and cyber posture, as well as periodic renewals of due diligence commensurate with their risk. This approach is designed to mitigate risks related to data breaches or other security incidents originating from these third parties.


text: As of the date hereof, we have not identified any cybersecurity threats or previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Part I. Item 1A. Risk Factors."


text: Cybersecurity Governance The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms for effective governance in managing risks associated with cybersecurity threats, because they recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is responsible for the Board of Directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, cyber operations, risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee reviews our cybersecurity programs and the effectiveness of its risk management strategies. This review helps management identify areas for improvement and align our cybersecurity program with the overall risk management framework.


text: The Chief Information Officer ("CIO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. The CIO provides briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;


text: incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, select members of the Audit Committee and CIO maintain an ongoing dialogue regarding potential cybersecurity threats and mitigation strategies and updates to our cybersecurity posture. The Audit Committee oversees strategic decisions related to our cybersecurity program, offering guidance and approving investments in major initiatives. This ongoing oversight enables cybersecurity considerations to be integrated into our broader strategic planning objectives.


text: Reporting to our CIO, our cybersecurity function is led by our Chief Information Security Officer ("CISO"). The CISO manages a team of cybersecurity professionals and third-party support functions with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our CISO and CIO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to contain and eradicate the threat, mitigate the impact, and long-term strategies for remediation and prevention of future incidents.


text: The CIO regularly informs the Chief Executive Officer and management regarding cybersecurity risks and incidents, so they are kept abreast of the cybersecurity posture and potential risks. Significant cybersecurity matters and strategic risk management decisions are reported to the Audit Committee.


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management process. Our executive officers, along with input from our outsourced IT managed services provider, other external experts, and department managers, are responsible for our overall enterprise risk assessment and management process and regularly consider cybersecurity risks in the context of other material risks to the Partnership. We obtain input on the security industry and threat trends for our cybersecurity risk management processes from external experts, as appropriate. Our outsourced IT managed services provider has expertise in areas including, but not limited to, information technology and infrastructure, network and communications architecture, information systems and database management, back up management, and cybersecurity.


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing our employee, business, or customer data.


text: To protect our information systems from cybersecurity threats, we, among other things: (i) conduct regular reviews of information systems security programs and policies, (ii) perform penetration testing using external third party tools and techniques to test security controls, (iii) provide employee training, (iv) monitor emerging trends, laws, and regulations related to data protection and information security, and (v) use various security tools that help monitor, prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, monitoring and detection tools managed by external experts and internal reporting.


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, CFO, and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the CEO. We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.


text: The Advisory Committee of the Board of Managers of the general partner of our General Partner has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board of Managers for consideration. Reports are periodically provided to the Advisory Committee during our board meetings by the individuals who oversee risk management in cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Members of the Board of Managers also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A – Risk Factors".


text: Risk Management and Strategy We strive to implement leading data protection standards to ensure a strong commitment to cybersecurity. Our Data Security Policy and Cybersecurity Incident Response Plan ("CIRP"), which is part of our enterprise wide risk management processes, guides our cybersecurity program. The CIRP, developed in consultation with an independent cybersecurity expert, includes processes for identifying, managing, and remediating cybersecurity incidents. We utilized the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") guidelines to develop and implement the CIRP, which is approved by our Chief Technology Officer ("CTO"). However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we used the NIST and CIS as a guide to help create develop and implement the CIRP. The CIRP is reviewed and updated annually. The Company's cybersecurity risk management processes include ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes an enterprise Attack Surface Management tool to routinely scan for vulnerabilities to internal assets. Externally, we use third-party vendors to routinely conduct scans for vulnerabilities to external assets. In addition, our internal auditors along with management also conduct periodic monitoring of our internal controls over our data security and customer privacy systems and processes.

companyName: GRAY MEDIA, INC

ticker: GTN


text: For many vendors for the Company, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports, to support our assessment of our vendors' security practices. In collaboration with the National Association of Broadcasters, North American Broadcasters Association, and risk management vendors, we are also working to assemble broadcaster-specific guidelines for information technology vendor selection.


text: The Company provides security awareness training for all employees on a regular basis. The training is designed to educate and prepare employees to recognize unsafe practices and to properly respond to phishing attacks from email, social media, and other sources. Follow-up testing using simulated attack tools is used to validate the effectiveness of training and compliance.


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We have experienced both targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to limited, non-critical information and systems that were detected by our security processes. Nevertheless, we could in the future experience similar or more severe attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".


text: Management is responsible for the Company's day-to-day risk management and the Board serves in an oversight role. The Board has empowered the Audit Committee with formal oversight of enterprise risk matters, including with respect to cybersecurity. The Audit Committee and management periodically review the Company's policies with respect to risk identification, assessment, and management, including cybersecurity risk exposures and the internal controls and procedures in place to manage such risks, as well as the steps that management takes to monitor and control such exposures. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues.


text: The Cybersecurity Incident Response Team ("CIRT"), which is led by the CTO, is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and conducts primary incident response efforts. Our CTO, who is responsible for assessing and managing the Company's cybersecurity risks, has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at Raycom Media prior to the Raycom Merger. Other team members of the CIRT also have relevant educational and industry experience, including holding similar positions at large companies. Incidents can be escalated up to our executive leadership team, depending on the severity of the incidents. Our President and/or CTO regularly report to our Board, and our CISO and General Counsel regularly report to our Audit Committee about our cybersecurity health and initiatives. In addition, the Board receives quarterly reports on risk management activities across Gray operations, including with respect to cybersecurity.


text: As a foundation of this approach, our privacy and security policies govern our business lines and subsidiaries. We monitor the privacy and security regulations applicable to us in the regions where we do business as well as proposed privacy and security regulations and emerging risks.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Our Audit Committee is informed of such risks through reports from our Chief Information Officer ("CIO") on at least an annual basis.


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for six years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows:


text: The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents.


text: The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team.


text: The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation.


text: The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.


text: At the level of the general employee population, we hold trainings on privacy and information security, records and information management, and information security regulatory compliance, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through broad communication and educational initiatives, depending on the employee's level, role and exposure to sensitive systems and the associated cybersecurity risk profile. We also contract with an external vendor to monitor alerts in real time on cybersecurity incidents.


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of Bimini. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: As an externally managed company, the Company relies on our Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on our Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by our Manager. All of the Company's executive officers are executive officers, directors and employees of Bimini.


text: Our Manager's cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.


text: Risk Management and Strategy The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged, including a presentation from the third-party security firm.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our Manager's information technology team and a third-party security firm.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of the third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Incident Response and Recovery Planning: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our Manager's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: A third-party security firm provides training to our Manager's employees, helping our Manager's information technology team to maintain a state-of-the-art cybersecurity system and stay up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our Manager's information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency RMBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives reports from management, the Manager's information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary.


text: As noted above, the Company relies on its Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by its Manager. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our Manager's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate.


text: Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately twenty years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.