text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our Audit Committee of the Board of Directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity. The individual currently operating as our vCISO has over 15 years of experience in providing services as an enterprise vCISO across various industries, including life sciences and national defense and has advised various agencies of the U.S. federal government.

companyName: CRISPR Therapeutics AG

ticker: CRSP

secItem: Item 1C


text: As part of our Board of Directors', or Board's, enterprise risk management program, our Board has responsibility for oversight of cybersecurity risk management. Our Board has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT and vCISO provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors.


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Risk Management and Strategy. We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the Company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the Company's response to computer security incidents when activated.


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the Company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. The company engages consultants, auditors, and other third parties to identify and manage risk from third parties.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, be subject to litigation or incur remediation costs or penalties because of the unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: Governance. The company's board of directors oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our chief information officer, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who has responsibility for information security strategy and operation. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Risk Management and Strategy The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cyber security update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. The cyber security Steering Committee meets multiple times throughout the year to discuss the Company's cyber security programs and practices, risk management related to cyber security and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cyber security professionals with decades of relevant experience. Most notably, the Company's Enterprise Manager of Cybersecurity and Network holds a Certified Information Systems Security Professional (CISSP) certification and has over 15 years of experience with managing risks arising from cybersecurity threats.


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plans (IRP). Through the ongoing communications from these teams, the Steering committee monitors the effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any credible threats or security concerns to the Board when appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store sensitive data, including intellectual property, proprietary business information of ours and that of our suppliers and partners, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our partners and third-party providers also possess certain of our sensitive data. The secure maintenance of all such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, and it is designed to identify, assess, help mitigate, and monitor information technology risks across the organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party risk management, audit management, incident response and security awareness, including employee security awareness trainings and other initiatives. Our ISMS also includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks identified and managed thereby, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS specifically and our information security program generally.


text: As part of our information security program, we also have a program in place for management of cybersecurity risks associated with third-party handling of our confidential information, including their provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and our application of established mechanisms for ongoing monitoring of such third parties, including tools such as security ratings services and periodic reassessment questionnaires.


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Governance and Oversight We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.


text: Our information security team, led by our Chief Information Officer, is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. The information security team is managed on a day-to-day basis by our Director and Executive Director of Information Security and works cross-functionally throughout the organization to assess and prepare the Company for identification and mitigation of, and if necessary response to, information security risks. Our information security team members collectively have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to information technology and cybersecurity and mitigations put in place, or to be put in place, in response to such risks. The audit and risk committee periodically reports to the full board of directors regarding the audit and risk committee's oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our Chief Information Officer and our Executive Director of Information Security on the ISMS and other information security initiatives, and on our information security governance framework.


text: The Company maintains a comprehensive cybersecurity management and governance program. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR INC

ticker: PCAR


text: The Company's Security Risk Council, including the Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the Company's Security Risk Council evaluates its significance and briefs the Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.


text: Crescent's Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.


text: Since our commencement of operations, we have not experienced a material cybersecurity incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships"


text: Information security is the responsibility of our Information Security and Compliance department, overseen by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). We leverage a combination of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST Security and Privacy Controls for Information Systems and Organizations, International Organization for Standardization ("ISO 27001"), the American Institute of Certified Public Accountants ("AICPA) SOC 2 set of security controls, and Center for Internet Security best practice standards to measure our security posture and manage risk. We implement both preventative and detective mechanisms, as well as processes, controls, and tools in layers. These layers include applications, systems, network, third-parties, personnel and physical security. We implement this system via governance, risk management, policy, education, security engineering, security compliance, security operations, and application security.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Our Incident Response Plan ("IRP") establishes the incident response ("IR") policies and procedures to position our organization to timely and effectively address cybersecurity incidents that could, or may have, compromised sensitive and/or personally identifiable information ("PII"), or have a serious impact on our ability to accomplish our mission. The IRP also specifies the organizational methods for the preparation, detection, analysis, eradication, and containment of an incident. The IRP describes the roles, responsibilities, and actions of the Incident Response Team ("IRT") to analyze, classify, and manage security events and incidents, including but not limited to, unauthorized access, alteration or compromise, denial of service, malicious code, or misuse.


text: To implement our policy, we maintain a comprehensive IR process containing detailed information on points of contact, response procedures, and training. We perform an annual security incident response exercise to test the effectiveness of the incident response process we have established. The annual test consists of scenario-based tabletop exercises that involve members of the IRT and cover specific types of incidents. These exercises also provide a mechanism to train personnel with security incident response duties to understand the roles, responsibilities, and procedures they have within the plan. In addition, we conduct regular security awareness trainings for all of our employees, and carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Additionally, our security team conducts regular vulnerability scans of both our non-public assets and our production environments, using a number of internal and external tools, custom scripts, and monitoring agents to watch for open-source libraries and dependency vulnerabilities. In addition to regular scanning and periodic internal security audits conducted throughout the year, we conduct open, third-party security reviews, including year-round bug bounty penetration testing.


text: We utilize several third-party organizations to host our products for customers. We monitor the secure provision of these services, our security team performs thorough vetting prior to, and periodically throughout the relationship with third-party vendors. To help provide reasonable security assurance of the security practices and mechanisms at these third parties, we request and review copies of the third-party assurance reports provided by these organizations on an ongoing basis to confirm their controls are operating effectively. Legal contracts with these third parties also include security provisions to help ensure the implementation and operation of effective security controls at the third-party organizations. Furthermore, we host all customer-facing web applications and supporting infrastructure on AWS. We rely on AWS' ability to design and operate the critical mechanisms and controls to protect physical access to data and availability of our services. AWS has represented to us that their data centers utilize state-of-the-art electronic surveillance and multi-factor access control systems, among other security measures, including permanent trained security guards and limited access.


text: In the last three years, neither we nor our third party provider have experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. For additional information about the Company's cybersecurity risks, please refer to "Risks Related to our Technology and our Intellectual Property Rights" in Item 1A, "Risk Factors."


text: While our full board of directors has overall responsibility for risk oversight, it has delegated to the Audit Committee oversight of our risk management process. Our Audit Committee is committed to regularly reviewing, advising and overseeing the effectiveness of our cybersecurity and data protection programs and practices, including controls, policies and guidelines, security strategy and technology planning, compliance, and preparedness and incident response planning. The Audit Committee reports to the full board of directors when a cybersecurity matter rises to the level of a material or enterprise level risk.


text: The CIO presents updates to the Audit Committee as needed and, also as necessary, to the board of directors. These reports include detailed updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the board of directors about any information security incidents that may pose significant risk to Instructure.


text: Our CIO has over 20 years of experience building, developing, and leading high-performance cloud, IT, and security teams globally—while strategically aligning IT and security services for organizational success. Prior to joining Instructure in 2021, he was SVP of Cloud Customer Operations and the Chief Information Security Officer at a business intelligence and analytics firm. Before that, he led global IT and information security for the largest dedicated global software security firm. He has a Master's Degree in Information Systems from George Mason University and a Bachelor's Degree in Computer Science from SUNY Buffalo.


text: Our CISO has 15 years of experience in Information Technology. During the last decade, he has focused on leading information security programs, with the aim of creating alignment and synergy between security programs and other business units. Prior to joining Instructure in 2022, he led the inauguration of an information security program and implemented strong and adaptable information security processes and controls at a retail technology company. Before that, he was Director of Information Security for a leading modern media company. He has both a Master's Degree and Bachelor's Degree in Information Security from Marymount University.


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR FINANCIAL CORP


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of PACCAR Financial Corp. (Millions of Dollars)


text: Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain PACCAR dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to PACCAR or the Company.


text: The Company recognizes the critical importance of assessing, identifying and managing material risks associated with cybersecurity threats, as well as developing, implementing and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We focus significant resources on protecting our technology infrastructure and the personal information therein regarding applicants, our students, their families, our alumni and our employees. Our principal cybersecurity risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The Board of Directors, as a whole, oversees the Company's risk management through both the Company's enterprise risk management program and the internal audit function. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.


text: The Board has delegated oversight of the Company's management of cybersecurity risk to the Compliance and Risk Committee (the "Committee"). Directors with experience in cybersecurity are appointed to this Committee to assist in developing strategies and processes for protecting against, responding to, and remediating information security breaches. Those directors are Dennis Chookaszian, Patrick Gross and Leslie Thornton. The Committee reviews information security matters quarterly. In addition, the full Board regularly receives updates on cybersecurity matters from our Chief Information Officer, David C. Czeszewski, at each board meeting. The Chief Information Officer reports on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, an assessment of the information security program, and the emerging threat landscape. Mr. Czeszewski has a Bachelor of Arts degree in business and computer studies and a Master in Business Administration. He has worked in the technology field since 1986, joined the Company in 2001, and has been its Chief Information Officer since 2013.


text: The Company also has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.


text: We engage third-party experts to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. These third-party experts perform periodic cyber assessments, including security assessments using the CIS Controls cybersecurity framework. Our processes address cybersecurity threat risks associated with our use of these third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risks to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss which could adversely affect our reputation, operations and ability to attract and retain students," and "Our remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating, overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: The Chief Operations Officer ("COO"), who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The COO uses both internal and external resources to execute this process including security tools that help prevent, identify, escalate, investigate and resolve security incidents in a timely manner and tools that help prevent unauthorized access. The Company, with the oversight of the COO, also requires all employees to complete an annual cybersecurity training course.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.


text: The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to expend significant resources to modify or enhance its measures to detect and prevent cybersecurity attacks or to investigate and remediate any information security vulnerabilities that become known. The risks faced by the Company from cybersecurity threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" as part of this Annual Report on Form 10-K.

companyName: M&T BANK CORP

ticker: MTB


text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It provides a common foundation for all employees and officers as well as directors to understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including the Operational Risk Committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.


text: The Risk Committee of the Board of Directors receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and information security program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks.


text: In accordance with the Gramm-Leach-Bliley Act, the Company undertakes periodic assessments to identify and assess risks to customer information and evaluate the effectiveness of security controls. The Company engages third parties in connection with such cybersecurity preparedness efforts. Ongoing audits, including vulnerability and penetration testing of the Company's computing infrastructure, are performed by independent third parties and by our internal cybersecurity personnel.


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Security Program. The Company has an established third-party due diligence program to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.


text: The Company's Cybersecurity Leadership Team includes the CISO, Mr. Timothy Byrd. Mr. Byrd is responsible for overseeing and reporting on the development and implementation of the Company's information security program. Mr. Byrd has over twenty years of experience in information security for large financial institutions. He also served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. Mr. Byrd currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. He holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.


text: The Company's Information Security Awareness Program, a component of the Security Program, is designed to ensure that all employees are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risk's, and to timely detect the occurrence, and mitigate the effects of, cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that is led by our CIO. The team in turn may leverage the expertise of third-party consultants, external legal counsel, and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident, and the breadth of the incident. The plan also establishes procedures for escalating incidents depending on severity and for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors, and insurance providers. Our CIO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process. In addition to internal resources, we utilize third-party service providers to supplement and maintain our cybersecurity and our information technology systems.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development and manufacturing, to communicate internally and externally, to operate our accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Gentherm Inc

ticker: THRM


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and our proprietary, strategic or competitive data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have an incident response process that relies on a multidisciplinary team for assessing and managing cybersecurity incidents, including an escalation framework based on the materiality of incidents. The multidisciplinary team includes members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions and third party service providers of technical, legal and insurance services, as well as coordination with law enforcement as appropriate. Our IT security function also addresses cybersecurity threats through regular vulnerability reviews, risk registry reviews and global team meetings.


text: Our information security processes are integrated into our overall enterprise risk management ("ERM") process and system. Our ERM process relies on designated risk managers to identify and assess material risks from cybersecurity threats. The risk managers form a multidisciplinary group including members of our IT security, finance, human resources and legal functions, operations and executive management, and are responsible for timely reporting of risks on an ongoing basis. Our ERM process includes an annual evaluation and ranking of the top risks captured in our ERM system against leading third party benchmark reports on global risks.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to support a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches and other disruptions to our information technology networks and systems, including a disruption related to cybersecurity, could interfere with our operations and could compromise the confidentiality of our proprietary information or personal information", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the quality and effectiveness of the control and enterprise risk management processes of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives reports and engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and reasonably manage these risks, including those that may result from material cybersecurity threats. The Audit Committee also receives reports on material cybersecurity and data privacy incidents (if any), which would include plans to mitigate and respond to such incidents, and status on key information security initiatives. These discussions include the Company's enterprise risk assessment and risk management policies.


text: The Technology Committee of the Board of Directors oversees the management of risks associated with the Company's products and technologies, including cybersecurity risks related to new product technologies or significant innovations to existing product technologies, in accordance with its charter.


text: Our Vice President & Chief Information Officer (the "CIO") leads our global information security organization and reports to the Board of Directors on matters related to cybersecurity on behalf of the Company's management. Our CIO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large industrial and technology companies.


text: Our CIO leads an internal IT Security Committee that meets regularly to oversee company-wide efforts to address cybersecurity threats, to assess the effectiveness of our information security program and to prioritize efforts to improve our security measures and planning. Our IT Security Committee includes members of our IT security function and executive management of our legal, finance and internal audit/risk, human resources and corporate communications and technology functions.


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees, and have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive Cybersecurity Program Assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy trainings included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • Third Party Cyber Risk Program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a Security Operations Center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our management team regarding cybersecurity matters.


text: We have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers. As part of these processes, we conduct cybersecurity due diligence where deemed advisable with respect to third-party service providers that will be accessing our information technology systems, including access to view or store sensitive data, prior to their engagement. Moreover, we have processes designed to oversee and identify material cybersecurity risks associated with the information systems of third-party service providers. In addition, third-party service providers that have access to our information technology systems, including access to view or store sensitive data, are contractually obligated to report cybersecurity incidents to us so that we can assess the impact of any such incident on our business.


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time. In particular, on February 13, 2023, we disclosed a security breach in which a third-party vendor that provides a secure file transfer software platform utilized by our subsidiaries experienced a security breach whereby personal information of certain patients of our healthcare facilities were exposed to the attacker.


text: We do not believe that risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially affects us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, privacy and data protection laws and regulations, consumer protection laws, common law or other theories, subject us to litigation and federal and state governmental inquiries and actions, damage our reputation, adversely impact our financial results and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.


text: We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board's oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Information Security Officer, or the CISO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CISO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CISO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.


text: At a management level, our cybersecurity risk management efforts are led by our CISO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2021. Our current CISO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service with the Company since 2021 and his service as chief information security officer at another large organization prior to being employed by us. In addition, other individuals on our IT security team have cybersecurity experience or certifications relevant to their respective role.


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the IT security team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, personal information, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").

companyName: Confluent, Inc.

ticker: CFLT


text: The Chief Information Security Officer, in coordination with the Chief Technology Officer, Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, red/blue team testing and tabletop incident response exercises, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, forensic investigators, dark web monitoring services, and professional service firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for each vendor, security questionnaires, audits, and review of security reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust, Security and Reliability department, and the members of the Cybersecurity Risk Management Team. Our Trust, Security and Reliability department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. Senior management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the management disclosure committee and to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • People - security awareness education and readiness-testing throughout the year for employees and contractors; • Process - incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • Technology - investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts an extensive periodic review of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to a separate committee comprised of officers charged with reporting responsibilities to determine overall materiality and disclosure obligations.


text: We have engaged an independent third-party operations center that is focused on, among other things, monitoring alerts, logs, behavior analytics and end devices usage. This continuous monitoring is in conjunction with periodic security assessments, constant vulnerability scanning and frequent penetration tests. We also complete an initial vendor cybersecurity review process for new cloud-based software which provides a standardized review assessment. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors allowing us to increase security of our technology assets and our data.


text: Our board of directors oversees our cybersecurity risk and receives a quarterly cybersecurity report and an update from management which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and on-going cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our Cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides to our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The Cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The Cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: DIRTT has developed and implemented a cybersecurity risk management strategy which consists of 5 phases: Identify, Protect, Detect, Respond, and Recover. Each phase has multiple processes and technologies supporting those processes. Identification processes at DIRTT include: system asset identification, threat identification, vulnerability identification and maintaining cybersecurity policies and standards.


text: Protection processes at DIRTT include: cyber awareness training, cyber awareness assessment (each employee is assigned a cybersecurity awareness grade calculated by a best in class cybersecurity vendor), implementation of identity and access controls, perimeter and endpoint security, annual vulnerability assessments and remediation, data encryption in transit, key vendor (third parties) control effectiveness assessment, and pre-implementation of software and systems cybersecurity assessments. Detection processes at DIRTT include: automated event collection, collation, analysis, alerting and end user incident reporting. Respond processes at DIRTT include: containment, communication, investigation and analysis, and long-term mitigation planning. Recovery processes at DIRTT include: impact identification and analysis, system restoration, internal and external communications as deemed necessary.


text: DIRTT engages external assessors annually for specific controls, to assess and provide assurance on the health of DIRTT's cybersecurity posture and controls.


text: DIRTT's Senior Vice President ("SVP") of Technology, who reports to the CEO, is responsible for DIRTT's cybersecurity and has over 15 years of technology experience. The SVP of Technology is supported by dedicated Cybersecurity staff and Governance, Risk and Compliance ("GRC") staff. DIRTT's cybersecurity team leader has over 20 years of experience in cybersecurity, multiple industry standard cybersecurity certifications, and extensive offensive and defensive cybersecurity tactical skills. DIRTT's GRC lead has over 20 years of GRC experience and industry standard certifications. Cybersecurity incidents, response and remediation activities and statuses are reported directly to the SVP of Technology.


text: The ERM of the Board of Directors oversees risks resulting from cybersecurity threats. DIRTT's management, represented by the SVP of Technology, is responsible for identifying, assessing, and managing risks arising from cybersecurity threats. Quarterly, DIRTT's SVP of Technology reports to the ERM on the health of DIRTT's cybersecurity, incidents, and emerging threats and vulnerabilities that may impact the Company.


text: As of the date of this Annual Report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's results of operations and/or financial condition. See "Item 1A. Risk Factors" for additional information about cybersecurity risk.


text: Cybersecurity Strategy and Risk Management We have established and maintain policies and processes for assessing, identifying, monitoring, and managing material risks arising from cybersecurity threats which form an important component of our overall risk management program. Our policies and processes underlie and support the integrity and availability of critical data and systems, and are designed to provide a framework for timely, effective responses to cybersecurity threats, such as threats associated with our services and with our use of services or technology products by our strategic vendors, contractors, or other suppliers. ACV also engages independent third parties to help us assess our internal preparedness, audit our adherence to cybersecurity standards, assist us with risk mitigation activities, such as security assessments and penetration testing, and identify areas for continued focus and improvement.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Our efforts are led by ACV's Chief Information Officer ("CIO") who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.


text: The Cybersecurity Department works with our strategic vendors, contractors, or other suppliers that provide services or technology products to complete information security risk assessments, each consisting of a holistic review using NIST as a standard. For these suppliers, operational security details, including third-party reports on compliance frameworks (such as NIST, SOC2 Type2), are reviewed by the Cybersecurity Department for sufficiency. The Cybersecurity Department uses tools to assist in monitoring cyber activities, benign and otherwise, and creates alerts based on anomalous activities or potential vulnerabilities. ACV personnel also are required to take cybersecurity training, which is designed to prepare our personnel to look out for and report any suspicious or anomalous events they may experience.


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee assists our board of directors in monitoring cybersecurity risks by receiving regular reports from our CIO, as needed, that cover information such as NIST review outcomes, and actions to address findings and vulnerabilities.


text: Our CIO has primary management responsibility for ACV's cybersecurity. He has over twenty- five years of experience working in information technology, with the last fifteen years in senior leadership and delivery roles in large, geographically spread corporate technology settings. Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), which governs ACV's responses to cybersecurity events and is designed to align with industry practices, when a cybersecurity event has been identified, it is assessed by our Cybersecurity Department based on a threat detection and response analysis to determine whether the event is a cybersecurity incident. Events that do not meet the standard of incident are resolved and closed out by the Cybersecurity Department in our cybersecurity event management system.


text: If an event is identified as an incident, the CIRP provides for notification to designated members of the Cybersecurity Department and the legal compliance function who will analyze the incident for potential materiality. Any incident whose impacts are judged to be potentially material is escalated immediately to a senior management team comprised of at least our CIO, Chief Legal Officer, Chief Operations Officer, and Chief Financial Officer. Additionally, certain cybersecurity events, such as a ransomware attack, will be immediately escalated to the designated members set forth above and the CIO. If the threat is found to be credible, it is further escalated on an emergency basis to the Chief Legal Officer and Chief Financial Officer. Once a cybersecurity incident is escalated to senior management, other members of management and senior management may be engaged to oversee the assessment, response, recovery, and disclosure efforts relating to such cybersecurity event.


text: Despite our efforts, we can offer no guarantees that the cybersecurity measures we use will prevent unauthorized or malicious access to ACV systems and information. For more information regarding the risks relating to cybersecurity, see "Risk Factors—Risks Related to Information Technology and Intellectual Property—Security breaches, cyber-attacks or other similar incidents with respect to our information technology systems, or those of our third- party service providers, could result in adverse consequences, including, but not limited to, a disruption of our business operations; reputational harm; loss of revenue or profits; regulatory investigations or actions; litigation; fines and penalties. If we fail to comply with our commitments, assurances or other obligations regarding data privacy and security, our reputation may be harmed and we may be exposed to liability; loss of business; and other adverse business consequences."


text: Risk Management and Strategy The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall Enterprise Risk Management (ERM) process. As part of the ERM, the Company focuses on developing multi-layered, collaborative processes to identify, monitor, and manage risks from cybersecurity threats. Risks are grouped into categories that management can then assess, monitor, and prioritize based on the likelihood of an occurrence, level of impact, and mitigating factors.

companyName: Alcoa Corp

ticker: AA


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.


text: The Company engages third party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including through the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms, including ongoing network monitoring. The Company also has a comprehensive third party information security audit program in place.


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third party service providers are subject to regular audits in which contract owners within Information Technology Automated Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.


text: We have in the past experienced attempts and incidents by external parties to penetrate our, our service providers', and our business partners' networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. See Part I Item 1A of this Form 10-K for more information on risks.


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.


text: Alcoa's CISO has twenty-five years of experience in Information Technology, carries multiple certifications in information security, and has extensive cybersecurity risk management experience in manufacturing organizations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee, which oversees current and emerging cybersecurity risks to the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO and CIO.


text: The Company has established comprehensive incident response plans that set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified, and elevated to an executive team which includes the CISO and executives on the Crisis Response Team. Once elevated, these executives are ultimately responsible for the management, mitigation, and remediation of incidents.


text: At Outset, we strive to protect the confidentiality, integrity and availability of the personal data entrusted to us. We continue to invest in our cybersecurity program in an effort to enhance our ability to prevent, detect, contain, and mitigate cybersecurity threats.

companyName: Outset Medical, Inc.

ticker: OM


text: Oversight of our information security program, including oversight of risks related to cybersecurity threats and the assessment and management of such risks, is accomplished through a governance structure which includes our Board, Audit Committee, and executive management.


text: BOARD AND COMMITTEE OVERSIGHT BOARD: One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.


text: Our full Board and Audit Committee are kept informed about significant risks related to cybersecurity, including enterprise-level risks from cybersecurity threats. The Board receives written updates, generally on a quarterly basis, regarding the status of our information security program. In addition, the Audit Committee receives in-person updates on our information security programs on at least an annual basis. These updates generally cover topics such as our cybersecurity strategy, the threat landscape, key cybersecurity risk areas facing the organization, any key findings of audits and testing, the status of key initiatives, as well as a review of any major incidents.


text: AUDIT COMMITTEE: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our Chief Technology Officer manages our information security program.