text: We operate in the logistics and crude oil distribution sector, which is subject to various cybersecurity risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, operations, cash flows or reputation.

companyName: ADAMS RESOURCES & ENERGY, INC.

secItem: Item 1C


text: While we have not experienced material cybersecurity threats or incidents, or threats or incidents that are reasonably likely to materially affect us, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Information on cybersecurity risks and threats we face can be found in Part I, Item 1A. Risk Factors—"Cyber-attacks or other disruptions to our information technology systems could lead to reduced revenue, increased costs, liability claims, fine or harm to our competitive position".


text: Our business depends on the availability, reliability and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, physical assets and infrastructure, customer service, product development and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our relationships, or loss of market share.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures we implement to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and Audit Committee receive reports and presentations from members of our senior leadership for overseeing our cybersecurity risk management, including our Corporate Information Technology Director, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Such members of our senior leadership also report to the Board directly at least annually on cybersecurity matters, including information security and cybersecurity risk.


text: At the management level, our Corporate Information Technology Director, who has extensive cybersecurity knowledge and skills gained from over 30 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to the Chief Financial Officer.


text: The Corporate Information Technology Director receives reports on information security and cybersecurity threats and, in conjunction with management, regularly reviews risk management measures we implement to identify and mitigate information security and cybersecurity risks. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: Risk Management and Strategy We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. This approach includes a variety of mechanisms, controls, technologies, methods, systems, protocols and physical safeguards, along with the use of third-party consultants and experts, that are reasonably designed to protect our information, and that of our stakeholders, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds.


text: We continue to improve our cybersecurity risk assessment program and activities for assessing, identifying and managing cybersecurity risks through industry standard security frameworks and leading practices, including risk assessments and remediations, software and services, continuous systems monitoring, vendor risk management processes, incident response plans, phishing simulations, employee training, and communication programs, among other measures. We also employ processes designed to assess, identify, and manage the potential impact of a security incident at various customers and critical partners, including third-party vendors, service providers, or any cybersecurity incident otherwise impacting the third-party technology and systems we use.


text: We engage with third-party service providers in order to maintain awareness of the latest security trends and continuously promote comprehensive cybersecurity practices consistent with industry best practices.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - IT outages, data loss, data breaches and cyberattacks could disrupt operations and compromise our intellectual property or other sensitive information, be costly to remediate or cause significant damage to our business, reputation, financial condition and results of operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Finance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives a briefing from management on our cyber risk management program at least annually. Board members receive presentations on cybersecurity matters from our Chief Information Security Officer (CISO), information security team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, led by our CISO and Sr. Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Sr. Director of Information Security has served in various roles in information technology and information security for over 20 years and holds multiple industry-recognized certifications. Our CISO, who is also our Chief Information Officer, has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.


text: Our management team, led by our CISO and Sr. Director of Information Security, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), AI Risk Management Framework (AI RMF) and other industry practices and standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF, AI RMF, and other industry practices and standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key components of our cybersecurity risk management program include: • periodic risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, evaluate, test or otherwise assist with aspects of our security controls and processes; • active testing including penetration tests, attack simulations and tabletop exercises; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives a briefing from management on our cyber risk management program at least annually. Board members receive presentations on cybersecurity matters from our Chief Information Security Officer (CISO), information security team or external experts as part of the Board's continuing education on topics that impact public companies. The CISO reports to the Chief Information Officer (CIO).


text: Our CISO has primary responsibility for our overall cybersecurity risk management program, and directly supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO has over 19 years of experience in cybersecurity including security operations, security architecture, identity and access management, cloud security, vulnerability management, and application/product security, policy, and compliance.


text: Our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity risk management and oversight are of utmost importance to Air Products and are necessary to maintain the trust and confidence of our customers, employees, and other stakeholders. The Company has implemented a thorough cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats as a fully integrated component of the Company's overall Enterprise Risk Management ("ERM").

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: In fiscal year 2024, we achieved our primary cybersecurity risk management objective of having no material cybersecurity incidents. Over the past three years, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program is designed as a holistic program focused on predicting, preventing, detecting, and responding to cybersecurity threats across enterprise systems as well as the operational technology systems for our plants and pipelines.


text: The Company regularly assesses industry best practices, frameworks, and standards, and leverages them to advance its cybersecurity risk management maturity. These frameworks include the International Society of Automation and the International Electrotechnical Commission standards for industrial automation, as well as the National Institute of Standards and Technology.


text: Our cybersecurity program includes procedures for the detection, analysis, and mitigation of cybersecurity incidents. Our cybersecurity incident response includes criteria for prioritization and escalation based on severity under an established incident prioritization framework. Incidents are reported internally to senior management, the Board or the Board's Audit and Finance Committee, as appropriate based on the potential severity of the incident. Incidents that are elevated based on their potential severity, including any event that is potentially material, are promptly escalated and analyzed for potential external reporting requirements.


text: As part of the Company's information security training program, all employees participate in various cybersecurity awareness activities, including an annual Information Security Awareness training module and monthly simulated phishing events.


text: We leverage third-party service partners to expand the capabilities of our cybersecurity program. This may include testing of the program's protection measures as well as services for incident detection, investigation, and recovery. We also leverage third-party service providers to conduct tabletop exercises and perform assessments against cybersecurity frameworks.


text: Our suppliers and third-party service providers are subject to cybersecurity obligations. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit Air Products' information.


text: The Company maintains policies and procedures for preventive controls for enterprise applications including, but not limited to, access controls and change management. In addition, we maintain relevant business continuity and disaster recovery plans as part of our overall cybersecurity risk management strategy.


text: For a discussion of risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors recognizes the importance of cybersecurity and has oversight responsibility for cybersecurity risks. The Board of Directors receives updates on our cybersecurity program at least quarterly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). In addition, the Board's Audit and Finance Committee, which is composed entirely of independent directors, receives quarterly reports regarding our ERM program and top risks, including those relating to cybersecurity.


text: Our CIO is a member of the Company's Management Board and is responsible for the administration of the cybersecurity risk management program. Prior to joining the company in 2020, our CIO spent 24 years in the aerospace and defense industry and held multiple senior leadership roles within digital technology, leading large global organizations in all aspects of digital technology, including cybersecurity risk management.


text: Under the direction of our CIO, our CISO leads the execution of the cybersecurity risk management program for our enterprise and operational technology systems. Our CISO is a seasoned cybersecurity executive with over 30 years of broad digital technology experience at Air Products. Our CISO has experience in leading global enterprise and operational technology cybersecurity programs, maintains a Certified Information Systems Security Professional certification, and has completed CISO executive education at Carnegie Mellon University. The Information Security leadership team that reports to the CISO is composed of four security leaders with over 80 years of combined experience and multiple professional certifications.


text: Our CISO has announced his intention to retire at the end of December 2024. The Company expects to appoint a successor in the near future.


text: Cybersecurity risk management and oversight are of utmost importance to Air Products and are necessary to maintain the trust and confidence of our customers, employees, and other stakeholders. The Company has implemented a thorough cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats as a fully integrated component of the Company's overall Enterprise Risk Management ("ERM") process.


text: In fiscal year 2025, we achieved our primary cybersecurity risk management objective of having no material cybersecurity incidents. Over the past three years, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program is designed as a holistic program focused on predicting, preventing, detecting, and responding to cybersecurity threats across enterprise systems as well as the operational technology systems for our plants and pipelines. This program involves relevant employees as well as third-party subject matter experts who collaborate to identify and proactively address risks.


text: The Company regularly assesses industry best practices, frameworks, and standards, and leverages them to advance its cybersecurity risk management maturity. These frameworks include the International Society of Automation and the International Electrotechnical Commission standards for industrial automation (ISA 62443) and information security (ISO 27001), as well as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Our cybersecurity program includes risk-based procedures for the detection, analysis, and mitigation of cybersecurity incidents. Our cybersecurity incident response includes criteria for prioritization and escalation based on severity under an established incident prioritization framework. Incidents are reported internally to senior management, the Board or the Board's Audit and Finance Committee, as appropriate based on this framework. Incidents that are elevated based on their potential severity, including any event that is potentially material, are promptly escalated and analyzed for potential external reporting requirements.


text: As part of the Company's information security training program, all employees participate in various cybersecurity awareness activities, including an annual Information Security Awareness training module and monthly simulated email phishing events. In addition to our internal resources, we leverage third-party service partners to expand the capabilities of our cybersecurity program. This may include testing the program's protection measures as well as services for incident detection, investigation, and recovery. We also leverage third-party service providers to conduct tabletop exercises and perform assessments against cybersecurity frameworks. In fiscal year 2025, Air Products conducted a comprehensive internal audit of its cybersecurity program to evaluate the effectiveness of controls across enterprise information technology, operational technology, and pipeline environments.


text: Our suppliers and third-party service providers are subject to cybersecurity obligations. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit Air Products' information. In many cases, our agreements include requirements for suppliers and other service providers to notify us if they suffer a cybersecurity incident that may affect us.


text: For a discussion of risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors - Risks Related to Our Business - Risks related to the approval, execution, and operation of our projects, particularly with respect to our largest projects, may adversely affect our operations or results of operations, of this Annual Report on Form 10-K.


text: Our CIO is a member of the Company's senior executive leadership team and is responsible for the administration of the cybersecurity risk management program. Prior to joining the company in 2020, our CIO spent 24 years in the aerospace and defense industry and held multiple senior leadership roles within digital technology, leading large global organizations in all aspects of digital technology, including cybersecurity risk management.


text: Under the direction of our CIO, our CISO oversees the development and implementation of our enterprise-wide cybersecurity risk management program, ensuring the protection of both enterprise and operational technology systems. Our CISO joined the Company in 2025 with an extensive background in cybersecurity strategy, governance, risk, compliance, and data protection. Prior to joining Air Products, our CISO spent over 25 years in executive security and operations management across the industrial manufacturing, software, and financial services industries. Our CISO maintains professional certifications in cybersecurity and information management, including as a Certified Chief Information Security Officer, Certified Information Systems Security Professional, and Certified Information Systems Manager.


text: The Information Security leadership team that reports to the CISO is composed of four security leaders with over 80 years of combined experience and multiple professional certifications.


text: Risk Management and Strategy Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats is aligned with Vornado's strategy as the Company's manager, which involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: ALEXANDERS INC

ticker: ALX


text: Our manager's cybersecurity risk management program, which is subject to our oversight, is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, which includes a rigorous vetting process and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees the implementation of the cybersecurity risk management program.


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Vornado's Chief Information Officer. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management, along with Vornado's Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Management and Vornado's Chief Information Officer have primary responsibility for our overall cybersecurity risk management program and supervise both the internal cybersecurity personnel and external cybersecurity consultants. Vornado's Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, which includes a rigorous vetting process and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business, results of operations, or financial condition.


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Vornado and its Chief Information Officer. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management, along with Vornado, is responsible for assessing and managing our material risks from cybersecurity threats. Management and Vornado have primary responsibility for our overall cybersecurity risk management program and supervise both the internal cybersecurity personnel and external cybersecurity consultants. Vornado's Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Vornado; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We have implemented policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Risk Management and Strategy As part of our broader approach to risk management, our cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Our strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, we routinely evaluate opportunities to refine our cybersecurity program in order to mitigate operational network risks. We include business continuity planning as a component of our strategy to help ensure critical systems are available to support our company in the instance of a disruptive event. We also participate in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, we assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of our corporate and operational networks. We maintain a training program to help our personnel identify and assist in mitigating cybersecurity and data security risks. Our employees and Board members participate in annual training, user awareness campaigns and additional issue-specific training as needed. We also provide annual training for certain contractors who have access to our information technology networks.


text: With respect to third party service providers, our information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. We seek to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by applicable law. We also seek to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect our systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: Our cybersecurity leadership team consists of our Director and Chief Information Security Officer (our "CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Our CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.


text: Risks that could affect us are an integral part of our Board and Audit Committee deliberations throughout the year. Cybersecurity risks are integrated into our enterprise risk assessment process, which is reviewed by our Board at least annually. Our Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee has been delegated the authority to oversee and periodically review the security of our information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with management our cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including our risk assessment and risk management policies. On a quarterly basis, our cybersecurity leadership team updates the Audit Committee on the overall status of our cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Facilities, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: On an ongoing basis, we assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of our corporate and operational networks. We maintain a training program to help our personnel identify and assist in mitigating cybersecurity and data security risks. Our employees and Board members participate in annual training, user awareness campaigns and additional issue-specific training as needed. We also provide annual training for certain contractors who have access to our information technology networks.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: Our cybersecurity leadership team consists of our Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Projects, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented processes for identifying, assessing, and managing cybersecurity risks as part of our overall enterprise risk management program. These processes are designed to protect our information technology and operational systems against cybersecurity threats. In connection with the operation of our program, we take into consideration guidance from various recognized cybersecurity industry frameworks and standards such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the International Organization for Standardization ("ISO") 27001 standards. This does not mean that we adhere to any particular frameworks or meet any particular standards, but rather that we use industry frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risk is collected as part of our overall enterprise risk management program, including as part of the annual enterprise risk assessment survey conducted by our internal audit team, the results of which are summarized and provided to our Audit Committee.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: We devote significant resources and efforts to protecting the security of our information technology and operational systems, including utilizing threat monitoring and commissioning assessments by third parties, taking guidance from ISO information security standards, and conducting proactive risk and compliance reviews against regulatory, industry, and evolving data privacy requirements. We provide training to our employees on our acceptable use policy, our data protection methods, and social engineering tactics used by threat actors, including through simulated phishing attacks. We maintain a cross-functional cybersecurity incident management procedure with defined roles, responsibilities, and reporting protocols that is designed to timely respond to, investigate, mitigate, remediate, and if appropriate, disclose, a cybersecurity incident. Furthermore, we practice our response to potential cybersecurity incidents through tabletop exercises.


text: As part of our selection process for certain third-party service providers, we evaluate components of their cybersecurity risk management programs using various factors. We engage third-party providers to provide ongoing threat monitoring, mitigation strategies, updates on emerging trends, security assessments, and penetration testing. We also receive updates from law enforcement and industry groups on emerging cybersecurity trends and the latest threats, and we have standing engagements with incident response experts.


text: As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. For additional information regarding risks we face, please refer to "We may not be able to prevent, or timely detect, information technology security breaches" in Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors ("Board") is responsible for our risk oversight, with the Audit Committee specifically overseeing management's cybersecurity risk management program. In this role, the Audit Committee receives quarterly updates from members of management, including the vice president, information technology and CIO, who oversees our information technology function ("CIO") and another vice president who supports the CIO in implementing, monitoring and updating the cybersecurity risk management program, as well as addressing existing and emerging cybersecurity threats and managing cybersecurity incidents ("Head of Information Security"). The Board receives regular reports from the Audit Committee, as well as an annual cybersecurity report from management, including the CIO, highlighting key activities of the Company's cybersecurity team, including internal initiatives and updates and external engagements with third party cybersecurity firms, recent incidents throughout the industry and the emerging threat landscape.


text: Our CIO has more than 25 years of experience in information technology and reports to our Chief Financial Officer. Our Head of Information Security, who reports to the CIO, has over 20 years of experience managing global information technology and cybersecurity operations and holds multiple industry-recognized certifications such as Certified Information Systems Security Professional and Certificate of Cloud Security Knowledge.


text: Cybersecurity Risk Management and Strategy We have developed and implemented processes for identifying, assessing, and managing cybersecurity risks as part of our overall enterprise risk management program. These processes are designed to protect our information technology and operational systems against cybersecurity threats. In connection with the operation of our program, we take into consideration guidance from various recognized cybersecurity industry frameworks and standards such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST") and the International Organization for Standardization ("ISO") 27001 standards. We are certified and externally audited to ISO / IEC 27001:2022. We leverage a controls framework, based on these industry frameworks and standards, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risk is collected as part of our annual cybersecurity risk assessment and overall enterprise risk management program, including as part of the annual enterprise risk assessment survey conducted by our internal audit team, the results of which are summarized and provided to our Audit Committee.


text: We devote significant resources and efforts to protecting the security of our information technology and operational systems, including utilizing threat monitoring and commissioning assessments by third parties, taking guidance from ISO information security standards, and conducting proactive risk and compliance reviews against regulatory, industry, and evolving data privacy requirements. We provide ongoing cybersecurity training to our employees based on access to our network and roles, which includes annual training to non-factory employees on our acceptable use policy, our data protection methods, and social engineering tactics used by threat actors. We maintain a cross-functional cybersecurity incident management procedure with defined roles, responsibilities, and reporting protocols that is designed to timely respond to, investigate, mitigate, remediate, and if appropriate, disclose, a cybersecurity incident. Furthermore, we practice our response to potential cybersecurity incidents through tabletop exercises.


text: Cybersecurity Governance Our Board of Directors ("Board") is responsible for our risk oversight, with the Audit Committee specifically overseeing management's cybersecurity risk management program. In this role, the Audit Committee receives quarterly updates from members of management, including the vice president, information technology and CIO, who oversees our information technology function ("CIO") and another vice president who supports the CIO in implementing, monitoring and updating the cybersecurity risk management program, as well as addressing existing and emerging cybersecurity threats and managing cybersecurity incidents ("Head of Information Security"). The Board receives regular reports from the Audit Committee, as well as an annual cybersecurity report or materials from management, including the CIO, highlighting key activities of the Company's cybersecurity team, including internal initiatives and updates and external engagements with third party cybersecurity firms, recent incidents throughout the industry and the emerging threat landscape.


text: Cybersecurity is a critical component of the Company's overall enterprise risk management program. Howmet has implemented a framework of principles, policies and technology designed to protect our systems and data from cybersecurity threats. The Company's Board of Directors (the "Board"), through its Cybersecurity Committee, is actively engaged in overseeing and reviewing the Company's cybersecurity programs and risk management. Although past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition or results of operations, the scope and impact of any future cybersecurity threat or incident cannot be predicted. See Part I, Item 1A. (Risk Factors) for more information on how material cybersecurity incidents may impact the Company.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: Howmet has implemented a multi-faceted cybersecurity risk management framework, which includes progressing toward achievement of the Cybersecurity Maturity Model Certification to certify the Company's compliance with certain cybersecurity standards published by the National Institute of Standards and Technology. We deploy and operate preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. Our approach includes conducting internal vulnerability assessments, external penetration testing and attack simulation. In addition, the Company subscribes to third-party managed security service providers that continuously monitor the Company's systems to assist with early cybersecurity threat detection and protection. Howmet conducts cybersecurity risk assessments of key vendors and other counterparties for any potential risks. Risk-based action plans are further developed to take into account evolving threats, which result in recommendations for new protocols and infrastructure. The Company has a robust program of employee education on the prevention of unauthorized access to Company information and systems.


text: The Company's cybersecurity risk management is integrated in our overall risk management processes. Our enterprise risks, including cybersecurity risks, are reviewed on a biannual basis. The review involves participation and engagement by, among others, subject matter experts like the Company's Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), the presidents of the Company's business segments, and executive management. Mitigation plans are deployed across the Company with cross-functional collaboration as applicable. Enterprise risk management is reviewed with the Board annually.


text: The Cybersecurity Committee, which originated in 2015 as a dedicated cybersecurity subcommittee of the Audit Committee, assists the Board in its oversight of the Company's cybersecurity programs and risks. Its responsibilities include reviewing the state of the Company's cybersecurity, its strategy, policies, and procedures to mitigate cybersecurity risks, and any significant cybersecurity incidents. The Committee also considers the cybersecurity threat landscape and the impact of emerging cybersecurity developments and regulations that may affect Howmet. The Cybersecurity Committee currently comprises two members and meets at least quarterly with members of management, including the CISO and CIO. The Cybersecurity Committee may, from time to time, invite third-party advisors and experts as it deems appropriate. Pursuant to guidelines adopted by the Cybersecurity Committee, management is required to report immediately to the Chair of the Cybersecurity Committee upon the occurrence of certain cybersecurity incidents and ransomware demands. The Cybersecurity Committee reports to the full Board after each of its meetings and as needed regarding the cybersecurity risks, incidents and other matters reviewed and considered by the Committee.


text: The Company's CISO leads management's assessment, prevention and management of cybersecurity risks. The CISO reports to the CIO who has responsibility for the usability, implementation and management of our information and computing systems. Both bring to their roles extensive experience in information technology and cybersecurity: • The Company's CISO joined the Company in 2022. The CISO has over 20 years of experience in information technology, cybersecurity and physical security management, including as Cybersecurity Operations Director at United States Steel Corporation (2020-2022); Director, Global Information Security and Compliance at Kennametal, Inc. (2018-2020); and Global Chief Information Security Officer/HIPAA Security Officer at Westlake Chemical (2013-2017). The CISO holds a Bachelor of Sciences degree in Information Systems Management from Carlow University and a Master of Sciences degree in Information Systems from Robert Morris University, and is a Certified Systems Security Professional. • The Company's CIO joined the Company in 2021. The CIO has over 20 years of experience in information technology, including, most recently, as Vice President Global IT and Chief Information Officer at Varroc Lighting Systems (2018-2021) and Chief Information Officer at AM General LLC (2016-2018). The CIO holds a Bachelor of Engineering degree in Industrial Engineering from Universidad de Lima.


text: In the event of a potential material cybersecurity incident or ransomware demand, Howmet has adopted a policy to respond to such event, which includes protocols and procedures to, among other things, escalate the incident or demand, form a core cross-functional response leadership team (including the CISO and CIO) to assess severity, formulate response and remediation, and determine any required reporting or notifications.


text: Cybersecurity is a critical component of the Company's overall enterprise risk management program. Howmet has implemented a framework of principles, policies, and technology designed to protect our systems and data from cybersecurity threats. The Company's Board of Directors (the "Board"), through its Cybersecurity Committee, is actively engaged in overseeing and reviewing the Company's cybersecurity programs and risk management. Although past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition, or results of operations, the scope and impact of any future cybersecurity threat or incident cannot be predicted. See Part I, Item 1A. (Risk Factors) for more information on how material cybersecurity incidents may impact the Company.


text: Howmet has implemented a multi-faceted cybersecurity risk management framework, which includes progressing toward alignment with cybersecurity standards published by the National Institute of Standards and Technology and achievement of the Department of Defense (DoD) Cybersecurity Maturity Model Certification, which will require companies like Howmet that do business with the DoD to obtain specific third-party certifications relating to specified cybersecurity standards to be eligible for new contract awards. We deploy and operate preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. Our approach includes conducting internal vulnerability assessments, external penetration testing, and attack simulation. In addition, the Company subscribes to third-party managed security service providers that continuously monitor the Company's systems to assist with early cybersecurity threat detection and protection. Howmet conducts cybersecurity risk assessments of key vendors and other counterparties for any potential risks. Risk-based action plans are further developed to take into account evolving threats, which result in recommendations for new protocols and infrastructure. The Company has a robust program of employee education on the prevention of unauthorized access to Company information and systems.


text: The Company's cybersecurity risk management is integrated in our overall risk management processes. Our enterprise risks, including cybersecurity risks, are reviewed on a biannual basis. The review involves participation and engagement by, among others, subject matter experts like the Company's Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), representatives of the Company's business segments, and executive management. Mitigation plans are deployed across the Company with cross-functional collaboration as applicable. Enterprise risk management is reviewed with the Board annually.


text: The Cybersecurity Committee, which originated in 2015 as a dedicated cybersecurity subcommittee of the Audit Committee, was made a formal committee of the Board in 2022. The Cybersecurity Committee assists the Board in its oversight of the Company's cybersecurity programs and risks. Its responsibilities include reviewing the state of the Company's cybersecurity, its strategy, policies, and procedures to mitigate cybersecurity risks, and any significant cybersecurity incidents. The Committee also considers the cybersecurity threat landscape and the impact of emerging cybersecurity developments and regulations that may affect Howmet. The Cybersecurity Committee currently comprises three members and meets at least quarterly with members of management, including the CISO and CIO. The Cybersecurity Committee may, from time to time, invite third-party advisors and experts as it deems appropriate. Pursuant to guidelines adopted by the Cybersecurity Committee, management is required to report immediately to the Chair of the Cybersecurity Committee upon the occurrence of certain cybersecurity incidents and ransomware demands. The Cybersecurity Committee reports to the full Board after each of its meetings and as needed regarding the cybersecurity risks, incidents, and other matters reviewed and considered by the Committee. The Company's CISO leads management's assessment, prevention, and management of cybersecurity risks. The CISO reports to the CIO who has responsibility for the usability, implementation, and management of our information and computing systems. Both bring to their roles extensive experience in information technology and cybersecurity: • The Company's CISO joined the Company in 2022. The CISO has over 20 years of experience in information technology, cybersecurity and physical security management, including as Cybersecurity Operations Director at United States Steel Corporation (2020-2022); Director, Global Information Security and Compliance at Kennametal, Inc. (2018-2020); and Global Chief Information Security Officer/HIPAA Security Officer at Westlake Chemical (2013-2017). The CISO holds a Bachelor of Sciences degree in Information Systems Management from Carlow University and a Master of Sciences degree in Information Systems from Robert Morris University and is a Certified Systems Security Professional. • The Company's CIO joined the Company in 2021. The CIO has over 20 years of experience in information technology, including, most recently, as Vice President Global IT and Chief Information Officer at Varroc Lighting Systems (2018-2021) and Chief Information Officer at AM General LLC (2016-2018). The CIO holds a Bachelor of Engineering degree in Industrial Engineering from Universidad de Lima.


text: The electric utility industry is an identified critical infrastructure function with mandatory cybersecurity requirements under the authority of FERC. The NERC, which FERC certified as the nation's Electric Reliability Organization, developed mandatory critical infrastructure protection cybersecurity reliability standards. AEP's service territory covers multiple NERC regions and is audited at least annually by one or more of the regions. AEP has participated in the NERC grid security and emergency response exercises, GridEx, for the past ten years and continues to participate in the bi-yearly exercises. These NERC-led efforts test and further develop the coordination, threat sharing and interaction between utilities and various government agencies relative to potential cyber and physical threats against the nation's electric grid. AEP also conducts internal exercises to test and further refine AEP's cyber response plans. These internal scenarios are chosen based on real world events and often include coordination with and communication to AEP's Chief Executive Officer and executive team.

companyName: AEP Transmission Company, LLC


text: The operations of AEP's electric utility subsidiaries are subject to extensive and rigorous mandatory cyber and physical security requirements that are developed and enforced by NERC to protect grid security and reliability. AEP's enterprise-wide security program includes cyber and physical security and incorporates many of the guidelines set forth in the National Institute of Standards and Technology Cybersecurity Framework. AEP has a primary and a back-up NERC Critical Infrastructure Protection Senior Manager, who is responsible for ensuring alignment of compliance with the enterprise-wide security program.


text: Critical cyber assets, such as data centers, power plants, transmission operations centers and business networks are protected using multiple layers of cybersecurity controls and authentication. Cyber hackers and other malicious actors have caused material disruption by successfully breaching a number of very secure facilities of entities across the spectrum of industries, including federal agencies and financial institutions. As understanding of these events develop, AEP has adopted a defense in depth approach to cybersecurity and continually assesses its cybersecurity tools and processes to determine where to strengthen its defenses. These strategies include monitoring, alerting and emergency response, forensic analysis, disaster recovery, threat sharing and criminal activity reporting. This approach has allowed AEP to deal with cyber and related threats, intrusions and attempted breaches in real-time and to limit their impact to levels that would be expected in the ordinary course of business in the absence of such malicious activity. AEP is not aware of any occurrence from cybersecurity threats, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect AEP's business strategy, results of operations, cash flows or financial condition.


text: AEP has undertaken a variety of actions to monitor and address cyber-related risks. Cybersecurity and the effectiveness of AEP's cybersecurity processes are reviewed annually with the Board of Directors and at several meetings throughout the year with the Technology Committee of the Board, the principal committee that exercises oversight with respect to these matters. AEP's Chief Executive Officer and executive team participate in interactive threat briefings from AEP's Chief Security Officer and/or Chief Information & Technology Officer on a regular basis. AEP's strategy and procedure for managing cyber-related risks is integrated within its enterprise risk management processes. These procedures are designed to ensure that any material information regarding potentially relevant cyber incidents is elevated in a timely manner both to the appropriate leadership and, where applicable, to our external financial reporting and disclosure team. AEP's enterprise-wide security program continually adjusts staff and resources in response to the evolving threat landscape. The costs for such investments are material and have remained generally consistent over time, a pattern that is expected to continue. In addition, AEP maintains cyber liability insurance to cover certain damages caused by cyber incidents.


text: AEP maintains dedicated cybersecurity and physical security teams which are responsible for the design, implementation and execution of AEP's security risk management strategy, which includes cybersecurity. AEP's cybersecurity team operates a 24/7 Cybersecurity Intelligence and Response Center responsible for monitoring the AEP System for cyber risks and threats. The cybersecurity team constantly scans the AEP System for cyber risks and threats. In addition, the cybersecurity team actively monitors best practices, performs penetration testing, leads response exercises and internal awareness campaigns and provides training and communication across the organization. AEP's security awareness training is mandatory for all employees and includes regular phish email testing to train employees to identify malicious emails that could put AEP at risk.


text: AEP also continually reviews its business continuity plan to develop an effective recovery strategy that seeks to decrease response times, limit financial impacts and maintain customer confidence during any business interruption. AEP administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. As warranted, AEP obtains certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of its information. The cyber security team works closely with a broad range of departments, including legal, regulatory, corporate communications, internal audit services, information technology and operational technology functions critical to the power grid.


text: The cybersecurity team collaborates with partners from both industry and government, and routinely participates in industry-wide programs that exchange knowledge of threats with utility peers, industry and federal agencies. AEP is an active member of a number of industry-specific threat and information sharing communities including the Department of Homeland Security's Joint Cyber Defense Collaborative, the Electricity Information Sharing and Analysis Center and the National Defense Information Sharing and Analysis Center. AEP participates in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities. AEP continues to work with nonaffiliated entities to do penetration testing and to design and implement appropriate remediation strategies. There can be no assurance, however, that these efforts will be effective to prevent material interruption of services or other damages to AEP's business or operations in connection with any cyber-related incident. See "Risk Factors - Risks Related to Market, Economic or Financial Volatility and Other Risks - Physical attacks or hostile cyber intrusions could severely impair operations, lead to the disclosure of confidential information and damage AEP's reputation".


text: The operations of AEP's electric utility subsidiaries are subject to extensive and rigorous mandatory cyber and physical security requirements that are developed and enforced by NERC to protect grid security and reliability. Cook Plant is also subject to NRC regulation for cybersecurity. AEP's enterprise-wide security program includes cyber and physical security and incorporates many of the guidelines set forth in the National Institute of Standards and Technology Cybersecurity Framework. AEP''s Chief Security Officer (CSO) has accountability for cyber aspects of third-party risk and data loss prevention and is also its NERC Critical Infrastructure Protection Senior Manager, who is responsible for ensuring alignment of compliance with the enterprise-wide security program. AEP's CSO possesses extensive experience across cybersecurity, risk and data controls and infrastructure engineering. AEP's CSO was the Chief Security Officer at Bread Financial Holdings, Inc., a publicly registered financial services company, and an executive director of cyber security at JPMorgan Chase & Co. prior to joining AEP.


text: AEP has undertaken a variety of actions to monitor and address cyber-related risks. Cybersecurity and the effectiveness of AEP's cybersecurity processes are reviewed annually with the Board of Directors and at several meetings throughout the year with the Technology Committee of the Board, the principal committee that exercises oversight with respect to these matters. AEP's Chief Executive Officer and executive team participate in interactive threat briefings from AEP's CSO and/or Chief Information & Technology Officer on a regular basis. AEP's strategy and procedure for managing cyber-related risks is integrated within its enterprise risk management processes. These procedures are designed to ensure that any material information regarding potentially relevant cyber incidents is elevated in a timely manner both to the appropriate leadership and, where applicable, to our external financial reporting and disclosure team. AEP's enterprise-wide security program continually adjusts staff and resources in response to the evolving threat landscape. The costs for such investments are material and have remained generally consistent over time, a pattern that is expected to continue. In addition, AEP maintains cyber liability insurance to cover certain damages caused by cyber incidents.


text: AEP's CSO leads the cybersecurity and physical security teams which are responsible for the design, implementation and execution of AEP's security risk management strategy, which includes cybersecurity. AEP's cybersecurity team operates a 24/7 Cybersecurity Intelligence and Response Center responsible for monitoring the AEP System for cyber risks and threats. The cybersecurity team constantly scans the AEP System for cyber risks and threats. In addition, under the direction of the CSO, the cybersecurity team actively monitors best practices, performs penetration testing, leads response exercises and internal awareness campaigns and provides training and communication across the organization. AEP's security awareness training is mandatory for all employees and includes regular phish email testing to train employees to identify malicious emails that could put AEP at risk.


text: We maintain an information security and cybersecurity program and a cybersecurity governance framework that are designed to protect our information systems against operational risks related to cybersecurity.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Cybersecurity Risk Management and Strategy We define information security and cybersecurity risk as the risk that the confidentiality, integrity or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Information security and cybersecurity risk is an operational risk that is measured and managed as part of our operational risk framework. Operational risk is incorporated into our comprehensive Enterprise Risk Management (ERM) program, which we use to identify, aggregate, monitor, report and manage risks. For more information on our ERM program, see "Risk Management" under "MD&A."


text: Our Technology Risk and Information Security (TRIS) program, which is our enterprise information security and cybersecurity program incorporated in our ERM program and led by our Chief Information Security Officer (CISO), is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our colleagues or our customers. The TRIS program is built upon a foundation of advanced security technology, employs a highly trained team of experts and is designed to operate in alignment with global regulatory requirements. The program deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. Those controls are measured and monitored by a combination of subject matter experts and a security operations center with integrated cyber detection, response and recovery capabilities. The TRIS program includes our Enterprise Incident Response Program, which manages information security incidents involving compromises of sensitive information, and our Cyber Crisis Response Plan, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills at both a technical and management level, and our colleagues receive annual cybersecurity awareness training.


text: In addition, we incorporate reviews by our Internal Audit Group and external expertise in our TRIS program, including an independent third-party assessment of our cybersecurity measures and controls and a third-party cyber maturity assessment of our TRIS program against the Cyber Risk Institute Profile standards for the financial sector. We also invest in threat intelligence, collaborate with our peers in areas of threat intelligence, vulnerability management, incident response and drills, and are active participants in industry and government forums.


text: Cybersecurity risks related to third parties are managed as part of our Third Party Management Policy, which sets forth the procurement, risk management and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our Third Party Lifecycle Management (TLM) program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring and termination. Our TLM program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional security requirements depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our customers, colleagues, regulators, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "A major information or cybersecurity incident or an increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure, and could reduce the use and acceptance of our products and services." under "Risk Factors."


text: Cybersecurity Governance Under our cybersecurity governance framework, our Board and our Risk Committee are primarily responsible for overseeing and governing the development, implementation and maintenance of our TRIS program, with the Board designating our Risk Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least once a year from our CISO or their designee. Our Risk Committee receives reports on cybersecurity at least twice a year, including in at least one joint meeting with our Audit and Compliance Committee, and our Board and these committees all receive ad hoc updates as needed. In addition, our Risk Committee annually approves our TRIS program.


text: We have multiple internal management committees that are responsible for the oversight of cybersecurity risk. Our Operational Risk Management Committee (ORMC), chaired by our Chief Operational Risk Officer, provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor and report information security risks associated with our information and information systems and potential impacts to the American Express brand. The ORMC escalates risks to our Enterprise Risk Management Committee (ERMC), chaired by our Chief Risk Officer, or our Board based on the escalation criteria provided in our enterprise-wide risk appetite framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Committee, the ORMC and ERMC.


text: Our CISO leads the strategy, engineering and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board, the ERMC and the ORMC on our TRIS program, as well as ad hoc updates on information security and cybersecurity matters. Our current CISO has held a series of roles in telecommunications, networking and information security at American Express, including promotion to the CISO role in 2013 and the addition of responsibility for technology risk management in 2023. Prior to joining American Express, our current CISO served in a variety of technology leadership roles at a public pharmaceutical and biotechnology company for 14 years. Our CISO reports to the Chief Information Officer, information about whom is included in "Information About Our Executive Officers" under "Business." For more information on our risk governance structure, see "Risk Management — Governance" and "Risk Management —Operational Risk Management Process" under "MD&A."


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our customers, colleagues, regulators, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyberattacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "A major information or cybersecurity incident or an increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure, and could reduce the use and acceptance of our products and services." under "Risk Factors."


text: Cybersecurity Governance Under our cybersecurity governance framework, our Board and Risk Committee are primarily responsible for overseeing and governing the development, implementation and maintenance of our TRIS program, with our Board designating our Risk Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least once a year from our CISO or their designee. Our Risk Committee receives reports on cybersecurity at least twice a year, including in at least one joint meeting with our Audit and Compliance Committee, and our Board and these committees all receive ad hoc updates as needed. In addition, our Risk Committee annually approves our TRIS program.


text: Our CISO leads the strategy, engineering and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board, the ERMC and the ORMC on our TRIS program, as well as ad hoc updates on information security and cybersecurity matters. Our current CISO has held a series of roles in telecommunications, networking and information security at American Express, including promotion to the CISO role in 2013, and is also responsible for technology risk management. Prior to joining American Express, our current CISO served in a variety of technology leadership roles at a public pharmaceutical and biotechnology company for 14 years. Our CISO reports to the Chief Information Officer, information about whom is included in "Information About Our Executive Officers" under "Business." For more information on our risk governance structure, see "Risk Management — Governance" and "Risk Management —Operational Risk Management Process" under "MD&A."


text: Technology Risk and Controls Committee (TRCC): The TRCC is used as a platform to assess risk and controls components across the information technology (IT) landscape including cybersecurity. It manages the risk assessment process, escalation and implementation of risk acceptance thresholds with the help of the GRC.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Regional, Country Risk and IT Risk Committees • Asia Pacific (APAC) Technology Risk and Controls (TRC) Forum • APAC - TRC Zone / Country Monthly Forums • Japan IT Risk Committee • Europe, Middle East and Africa region/UK and Latin America and Caribbean TRC Forum The above forums are set up for regional focus on IT, cybersecurity, regulations and overall issue management. The forums engage with the Company's relevant IT leaders and functional leaders within Enterprise Risk Management, Legal, Compliance, and Internal Audit.


text: Each of the Board and regional and country leadership boards may receive periodic presentations and reports on cybersecurity risks. In the event of a material cybersecurity incident, the Board will receive prompt information and ongoing updates about the incident. The Company has an established issue escalation protocol for technology incidents, including cyber related incidents. The Company's technology incidents and risks are tracked and rated. Items that are rated as "critical" are discussed in the TRCC, and escalated to the GRC as appropriate. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Global Chief Information Security Officer. The CISO and regional/country information security officers regularly present to the Company's regional and country leadership boards on material cyber risks and the Company's information security posture and strategy.


text: The CISO works collaboratively with business and functional colleagues to implement a program designed to protect the Company's information system from cybersecurity threats and promptly respond to potential cybersecurity incidents. Multidisciplinary teams are deployed to respond to cybersecurity incidents in accordance with the Company's incident response plans. Through ongoing communication from these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.


text: The CISO reports to the CIO and is principally responsible for overseeing the Program, in partnership with other business leaders across the Company including regional information security and technology officers. The Company's cybersecurity personnel maintain current knowledge through specific training programs, professional certifications, and participation in industry groups (e.g., Financial Services Sector Coordinating Council, Financial Services Information Sharing and Analysis Center, Analysis and Resilience Center, Securities Industry and Financial Markets Association, Cybersecurity and Infrastructure Security Agency, etc.). Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and quarterly sponsored simulated exercises to practice their response to real-life threats. In addition, personnel are encouraged to obtain industry approved certifications as appropriate for their roles and responsibilities. Below are some examples of certifications held by the Company's cybersecurity personnel: Certified in the Governance of Enterprise IT, Certified Information Systems Security Professional, Certified Information Security Manager, Certified Risk Information Systems Control, Global Information Assurance Certification (GIAC) Certified Incident Handler, GIAC Assessing and Auditing Wireless Networks, and GIAC Continuous Monitoring Certification.


text: Our CISO has more than 30 years' leadership experience in the field of information technology, cybersecurity, and adjacent roles spanning both military, corporate, and advisory roles. He maintains multiple professional certifications and has completed various academic and professional training courses, including the Federal Bureau of Investigation CISO Academy. In addition, he continues to serve on cybersecurity advisory councils and on the faculty of educational institutions focused on network security and information technology.


text: There have been no material cybersecurity incidents that have affected AIG for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Part I, Item 1A. Risk Factors – Business and Operations – "Our risk management policies, standards and procedures may prove to be ineffective and leave us exposed to unidentified or unanticipated risk, which could adversely affect our businesses, results of operations, financial condition and liquidity" and "We are exposed to certain risks if we are unable to maintain the availability of our critical technology systems and data and safeguard the confidentiality and integrity of our data, which could compromise our ability to conduct business and adversely affect our consolidated business, results of operations, financial condition and liquidity."


text: Reporting and Governance The Board and regional and country leadership boards may receive periodic presentations and reports on cybersecurity risks. We have an established issue escalation protocol for technology incidents, including cyber related incidents. In the event of a material cybersecurity incident, the Board will receive prompt information and ongoing updates about the incident. Our technology incidents and risks are tracked and rated. Items that are rated as "critical" are discussed in the TRCC, and escalated to the GRC as appropriate. At least once each year, the Board discusses our approach to cybersecurity risk management with the CISO. The CISO and regional/country information security officers regularly present to the Company's regional and country leadership boards on material cyber risks and our information security posture and strategy.


text: The CISO works collaboratively with business and functional colleagues to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. Multidisciplinary teams are deployed to respond to cybersecurity incidents in accordance with our incident response plans. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to senior management, who escalate to the Board as appropriate.


text: The CISO reports to the CIO and is principally responsible for overseeing the Program, in partnership with other business leaders across the Company including regional information security and technology officers. Our cybersecurity personnel maintain current knowledge through specific training programs, professional certifications, and participation in industry groups (e.g., Financial Services Sector Coordinating Council, Financial Services Information Sharing and Analysis Center, Analysis and Resilience Center, Securities Industry and Financial Markets Association, Cybersecurity and Infrastructure Security Agency, etc.).


text: Our CISO has extensive cybersecurity experience, maintains multiple professional certifications and has served in various roles in information technology and information security for over 25 years.


text: There have been no material cybersecurity incidents that have affected the Company for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Part I, Item 1A. Risk Factors – Business and Operations – "Our risk management policies, standards and procedures may prove to be ineffective and leave us exposed to unidentified or unanticipated risk, which could adversely affect our businesses, results of operations, financial condition and liquidity" and "We are exposed to certain risks if we are unable to maintain the availability of our critical technology systems and data and safeguard the confidentiality and integrity of our data, which could compromise our ability to conduct business and adversely affect our consolidated business, results of operations, financial condition and liquidity."


text: We take our responsibility for the privacy and security of the information our customers share with us seriously. Through our cybersecurity program, we constantly watch for threats to our systems and make real-time adjustments to our defenses to protect customer data and minimize service disruptions.

companyName: Unum Group

ticker: UNM


text: We identify and assess cybersecurity risks on an ongoing basis by maintaining a cybersecurity program that involves a defense-in-depth approach with multiple layers of security controls to protect our environment. We have invested in and deployed a security operating model involving people, processes, and technology that is designed to protect against potential and known cybersecurity risks and threats. Our cybersecurity program involves collaboration with partners, including financial industry groups, to understand and incorporate best practices and engage in cybersecurity threat intelligence sharing. Our security operations team includes internal threat hunters, such as cybersecurity engineers and analysts, who are working directly with third parties to monitor the threat landscape. Alerts from monitoring are analyzed by our security teams for preemptive engagement to avoid or minimize the impact of potential cyber threats. Additional cybersecurity tools are used to detect and block malicious attacks, as well as to govern identity and access management, in each case to avoid or minimize risks of unauthorized access to systems and data.


text: We utilize an internal global incident management team, comprised of executive and senior management-level personnel, that is responsible for oversight of our business resiliency and cybersecurity incident response programs. Within our information security organization, our cybersecurity incident response team works closely with the business resiliency team across business continuity, disaster recovery, and crisis management functions to plan, prepare, and practice response to simulated cybersecurity incident scenarios for response readiness. In the event of a cybersecurity incident, our incident response team would assess whether to engage the support of law enforcement or other third parties. In addition to our cybersecurity incident response team, we have retainers with leading incident response organizations to augment response activities, if needed. We also conduct one or more annual cybersecurity incident response tabletop exercises with senior management and third-party experts to test our incident response plan and enhance our readiness for a potential cybersecurity incident.


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls, and additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.


text: Cybersecurity risks associated with third-party service providers are managed in accordance with our Third-Party Risk Management (TPRM) program. Components of this program include cybersecurity due diligence and review of contractual terms with third parties that access our network or sensitive information. The TPRM program works to conduct appropriate review of all new third parties and performs ongoing monitoring of our existing relationships based on the risk presented by the third party.


text: As part of our cybersecurity program, we perform an annual cybersecurity risk assessment to evaluate our cybersecurity program and related controls. The cybersecurity risk assessment follows the guidelines published by the National Institute of Standards and Technology, which are aimed at identifying and determining the potential impact of threats and vulnerabilities and assessing the controls in place to mitigate those threats and vulnerabilities. Risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, operations, or financial condition.


text: Management's role in assessing and managing cybersecurity risks is led by our Chief Information Security Officer (CISO), who is a senior vice president and officer of the Company. As of the date of this report, our CISO has over twenty years of experience in information security leadership, including leading threat and vulnerability management, cybersecurity operations and cybersecurity defense, cybersecurity incident response, and technology risk management. He holds a bachelor's degree in computer science and several professional qualifications, including Certified Information Systems Security Professional and Information Systems Security Management Professional. The responsibilities of prevention, detection, mitigation, and remediation of cybersecurity incidents are allocated across the CISO's organization, and each organizational unit reports risks and incidents to the CISO, who in turn informs other senior management of cybersecurity incidents that may be material to the company.


text: Our cybersecurity program is overseen by the Information Security Committee (ISC), a cross-functional management committee whose membership include the CISO, Chief Risk Officer (CRO), Chief Technology Officer, Chief Compliance Officer, and others. Members of the ISC possess substantial experience in risk management, finance, and information security. The ISC is responsible for ensuring that the cybersecurity strategy and program align with our overall risk strategy. Our TPRM program is overseen by the Corporate Operational Risk Committee (CORC), a cross-functional management team whose membership includes leaders from our third-party risk management, corporate services, compliance, sourcing, information technology, and business resiliency teams. The CORC is responsible for ensuring risks to our non-insurance operational functions, including those related to third-party vendors, are identified and managed within our risk appetite, and that our TPRM program and strategy align with our overall business objectives.


text: The CORC and the ISC both report risks to our Executive Risk Management Committee (ERMC), which is comprised of senior management from our corporate functions and business segments and is responsible for overseeing our enterprise-wide risk management program. The ERMC is chaired by the CRO, who maintains a direct line of communication with the Risk and Finance Committee (RFC) of our board of directors.


text: The RFC is the board committee that oversees our cybersecurity risk management. Our CISO makes quarterly reports to the RFC about material cybersecurity risks, updates to the cybersecurity program, metrics that evaluate the effectiveness of the cybersecurity program, material cybersecurity incidents and remediation plans. The RFC also receives timely reports from the CISO when there are significant cybersecurity incidents or updates to the cybersecurity risk assessment. The board of directors also takes an active role in overseeing cybersecurity risk, including receiving an annual report from the CISO that provides an overview of the status and effectiveness of our cybersecurity risk management program and participating in cybersecurity incident response tabletop exercises.


text: See "Quantitative and Qualitative Disclosures About Market Risk" contained herein in Item 7A for further information. Also see "Risk Factors" included in Item 1A for additional information regarding cybersecurity risk.


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls. Our internal audit organization also provides independent assurance of the cybersecurity program through related audit engagements to complement external assessments and reviews. Additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.