text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Digital & Technology Officer ("CDTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, CDTO, and members of the Information Security, Information Technology and Privacy teams have broad experience and expertise in selecting, deploying and operating cybersecurity technologies, initiatives and processes around the world. Information about our executive officers' work experience, including our CDTO, is included in "Information about our Executive Officers" in Item 1, Business, of this Form 10-K.


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO and/or CDTO provide a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.

companyName: GAP INC

ticker: GAP

secItem: Item 1C


text: Our Internal Audit department facilitates an annual ERM assessment that is designed to gather information regarding key enterprise risks, emerging risks, critical risk events, and key third-party dependencies that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology and Privacy teams to gather information about risks related to cybersecurity threats. The ERM assessment is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan and any updates to the Company's enterprise risk profile, including identified cybersecurity risks.


text: Risk Management and Strategy Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors, and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management and business continuity planning processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls, and information systems.


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management, our Board and members of our Information Security, Information Technology, and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plan and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain an incident response plan to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.


text: To date, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Information Security and Technology" in Item 1A, Risk Factors, of this Form 10-K.


text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Technology Officer ("CTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO, CTO, and members of the Information Security, Information Technology, and Privacy teams have broad experience and expertise in selecting, deploying, and operating cybersecurity technologies, initiatives and processes around the world. Our CISO has nearly 25 years of experience in the information security and information technology fields. Our CTO has nearly 35 years of experience in these fields, including in technology leadership roles for large companies across multiple industries.


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO provides a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.


text: Our Internal Audit department facilitates an annual enterprise risk assessment ("ERA") that is designed to gather information regarding key enterprise risks, emerging risks, and critical risk events that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology, and Privacy teams to gather information about risks related to cybersecurity threats. The ERA is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan. The Audit and Finance Committee also reviews updates to the Company's enterprise risk profile, including identified cybersecurity risks, throughout the year. Additionally, key third-party dependencies are monitored as part of our overall business continuity planning, with the Audit and Finance Committee receiving periodic updates.


text: The Company's Board of Directors ("Board") recognizes the critical importance of maintaining the trust and confidence of our employees, customers, shareholders and other stakeholders. Among other areas of responsibility, the Board has oversight responsibilities in relation to the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies and practices are integrated into the Company's ERM program and our risk goals are guided by internationally recognized standards and frameworks that help us to identify, assess, and manage risks relevant to our business. In general, the Company manages our cybersecurity risk using an evidence- and risk-based approach designed to reduce risks and thereby protect the Company's mission, business, and stakeholders, rather than focusing upon meeting any specific technical specifications.

companyName: GATX CORP

ticker: GATX


text: Risk Management and Strategy The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.


text: We have not identified risks from known cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition.


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security.


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The Global Head of IT Security has served in various roles in information technology and information security for over 15 years, and holds undergraduate and graduate degrees in information security, as well as multiple certifications in cybersecurity and information technology.


text: Risk Management and Strategy The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. The incident response plan also includes consideration of disclosure requirements and communication to appropriate parties within the Company. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to senior management and the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security, who reports to the CIO and has responsibility for assessing and managing material risks from cybersecurity threats.


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The CIO has over 25 years of experience in information technology, including over 17 years managing the cybersecurity function and resources. The Global Head of IT Security has over 15 years of experience in information technology and information security, including 10 years of leadership roles within the information security domain, and holds certifications in cybersecurity and risk management.


text: We face various cybersecurity threats. The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: Under our comprehensive risk management program, the board of directors (Board) of the company maintains oversight of the most significant risks facing the company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, the Board receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.


text: Our companywide Cyber Council, comprised of information technology and cybersecurity executives from our business units, shares information and cybersecurity practices throughout the company, recommends policy and procedure updates and tracks emerging trends. The chair of the Cyber Council reports directly to the company's chief executive officer.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.


text: See Item 1A—Risk Factors above for additional discussion of various risks related to cybersecurity that are reasonably likely to have a material impact on our company, including our business strategy, results of operations or financial condition.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 15 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and information security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third party evaluations to our CIDO, who provides regular updates to our Audit Committee, Chief Executive Officer, and other members of our executive team. The Audit Committee receives regular updates specific to the Company's cyber security program and IT security risk, including descriptions of mitigation and incident response plans, projects to continually enhance our information security systems, overviews of awareness and training programs and the emerging threat landscape. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk & compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: GENUINE PARTS CO

ticker: GPC


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events are assessed using a variety of methods, and our incident response plan is enacted as needed. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security events. Security awareness training is also key component of our information security program and involves required training for all our teammates.


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company's cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events is assessed based on criticality, and mitigation and remediation actions are taken in accordance with our incident response plan. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises. Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."


text: Cybersecurity Risk Management and Strategy We operate in the engineered materials manufacturing sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws; and other litigation, legal and reputational risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive incident response plan and procedure that is tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, threat intelligence feeds, and penetration tests by an independent third party. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. The incident response team, which includes senior IT subject matter experts and security analysts, determines the apparent severity of reported potential incidents, and operationalizes the appropriate incident response plan. In addition, we continue to provide training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide feedback (and, if necessary, additional training or remedial action) to employees. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures should they occur.

companyName: Magnera Corp

ticker: MAGN


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, administrative functions, customer service, product development, and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Cybersecurity Governance The Company has increased its investment into combating cybersecurity risks which include increased Board Audit Committee oversight of IT's security risk reporting, formation of the Cybersecurity Steering Committee to directly govern IT cybersecurity strategies and strengthening the IT security management team which deploys resources to address cybersecurity risks on a day-to-day basis. Our internal cross-functional Cybersecurity Committee meets quarterly to discuss any issues and regulatory updates. The Board's Audit Committee exercises its oversight role and provides the Board with reports and findings from its annual cybersecurity meeting with management, including the Vice President of Global Information Technology and the Senior IT Director over Cybersecurity. Our Senior IT Director over Cybersecurity holds a Certified Information Systems Security Professional (CISSP) certification and has more than 25 years of experience in cybersecurity. Our Board also reviews our cybersecurity budget on an annual basis.


text: Our Chief Information Officer (CIO) has over 30 years of experience in cybersecurity and has primary management oversight of the Company's cybersecurity and cyber risk management activities. The CIO administers our cyber risk assessments, oversees ongoing risk management processes, and regularly reports to the Audit Committee. During fiscal 2025, the Audit Committee received regular briefings from the CIO on cybersecurity matters, including updates on current and emerging threats, progress on information security initiatives, assessments of the Company's cybersecurity program, and the results of internal and third-party evaluations.


text: Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks are addressed through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cyber security threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Assessments We engage third parties to perform assessments of our cybersecurity programs, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. (See Item 1A. Risk Factors).


text: Our cybersecurity program seeks to identify, assess and monitor material cybersecurity and other information technology risks and threats that may affect our information systems, networks and operations, including those systems and networks managed by third parties. We regularly assess potential risks and execute a layered cybersecurity strategy based on prevention, detection, mitigation, and remediation. The Company's cybersecurity risks are evaluated at least annually through our enterprise risk management program, which is a company-wide effort to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.

companyName: GRACO INC

ticker: GGG


text: To manage our cybersecurity program, we have established a cross-functional cybersecurity oversight committee and cybersecurity team, both led by our Chief Information Officer ("CIO"). Our cybersecurity oversight committee and cybersecurity team, with the support of external cyber-specialist resources, include technical experts in cybersecurity risk management, incident response and security operations with extensive experience in the operations of networks, network security and infrastructure management. In addition, members of our cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. Our CIO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity management team and through the use of technological tools and software.


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide training to our employees to help identify potential cybersecurity threats and attacks through an annual cybersecurity awareness month and targeted phishing campaigns. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risks and strategy. Management provides regular updates to the Audit Committee on cybersecurity risks facing the Company, the systems management has in place to mitigate and manage those risks, the status of key cybersecurity initiatives through a review of the Company's cybersecurity strategic roadmap and whether any material cybersecurity incidents have occurred. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes an update of the cybersecurity threat landscape, discussion of management's actions to identify and detect threats, and a review of assessments, penetration tests and other audits performed by internal and external parties. In addition, management periodically arranges for outside experts to present to the Audit Committee on cyber governance frameworks, regulatory developments, industry practices and risk management.


text: None of the cybersecurity risks, including as a result of any prior incidents we have experienced, have had a material adverse impact on our operations, business or financial condition.


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We periodically enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide annual cybersecurity awareness training to our employees and contractors to help identify potential cybersecurity threats and attacks, perform targeted phishing campaigns, use multifactor authentication for secure access to our systems and networks and tabletop exercises to simulate and prepare for potential incidents. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.


text: Risk Management and Strategy We recognize the importance of effective cybersecurity risk management to our operations and interests. Our cybersecurity program is designed to protect our employees, our customers and our assets through the effective identification and mitigation of cyber risks. The program, led by the Senior Director, Global Information Technology ("IT") Security under the oversight of the Chief Information and Digital Officer ("CIDO"), encompasses a broad range of preventative, detective and responsive measures relevant to our business needs and designed to reduce our specific risks.

companyName: GREIF, INC

ticker: GEF


text: The cybersecurity program is modeled after and assessed against the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF is not a certification program and our use does not imply compliance with specific, related standards – the NIST CSF is used as a guide for designing and managing cybersecurity programs.


text: Risks and exposures associated with our cybersecurity program are integrated into our overall enterprise risk management program and share common methodologies, reporting channels and governance processes. These processes and the governance for identifying and managing risks apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Core elements of our cyber program include, but are not limited to: • Risk assessments to identify cybersecurity risks that may impact us in material ways, including risks associated with our use of third-party service providers; • Cybersecurity awareness training for our employees and ongoing technical training for cybersecurity personnel; • Procedural and technical security controls implemented and managed by cross-functional teams; • An incident response plan that includes procedures for responding to cybersecurity events, including those arising from our use of third-party service providers or partners; • Periodic evaluation of security controls through system assessments and vulnerability scanning; • Partnerships with external providers where appropriate to supplement our internal expertise, perform security assessments and penetration testing, consult on best-practices and support incident response activities with forensic analysis.


text: As of October 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.


text: While our Board has responsibility for oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit Committee of our Board of Directors has responsibility for oversight of our cybersecurity risk management program. Full responsibilities of the Audit Committee are set forth in the publicly available Audit Committee Charter on our website. The Committee receives quarterly cybersecurity updates covering risks, mitigation plans, and cybersecurity incidents. The full Board of Directors is provided with periodic cybersecurity updates from the CIDO or the Senior Director, Global IT Security, or both.


text: In the event of an urgent cybersecurity incident where full Audit Committee or Board involvement is not practical or timely, the Chairperson of the Board of Directors, the Chairperson of the Audit Committee, and the Chief Executive Officer have been appointed as an incident oversight group.


text: Management Oversight The Senior Director, Global IT Security has primary responsibility for the management of ongoing cyber risks under the oversight of the CIDO. The Senior Director holds a Certified Information Systems Security Professional certification and has nearly 30 years of experience in technology, including over 10 years in software development and enterprise architecture and over 15 years implementing, maturing and leading cybersecurity programs. The CIDO is responsible for global IT strategy and operations and has nearly 30 years of experience leading enterprise technology organizations. The CIDO and Senior Director, together with others on their teams, are informed about the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management policies, processes and operations discussed above.


text: The Company's management team has designated a Cybersecurity Advisory Council (the "Council"), which consists of members of management, including the Senior Director, Global IT Security and a cross-section of Company leaders. The Council ensures strong alignment within the Company with the objectives of the cyber program, providing input on policy and risk decisions. The Council receives periodic briefings on security status, incidents, and mitigation plans.


text: The Company relies upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. Accordingly, the Company places an emphasis on managing cybersecurity risks by means of a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to the Company's business.

companyName: ENVIRI Corp

ticker: NVRI


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect the Company's information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned or managed by the Company. The Company places special weight on protecting sensitive information, such as personal information of the Company's customers and employees, and confidential business information that could be leveraged by a competitor or a malicious actor.


text: The Company's cybersecurity program comprises several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices; engaging third-party service providers to conduct security assessments and penetration testing; and performing periodic internal audits of the Company's cybersecurity protocols. The Company employs a risk-based process designed to manage cybersecurity risk presented by third-party vendors that may have access to the Company's sensitive information and/or information technology ("IT") systems. This process may consider the nature of the services provided, the sensitivity and quantity of information processed, the criticality of any potentially impacted IT systems, and/or the strength of the vendor's cybersecurity practices.


text: The Company monitors potential cybersecurity risks through an enterprise risk "heatmap" that tracks key cybersecurity risks at divisional and enterprise levels. These key risks are characterized by various factors such as the likelihood of the Company experiencing a particular type of cybersecurity incident, the speed at which each type of cybersecurity incident could impact the Company, and management's assessment of the Company's ability to respond quickly and efficiently.


text: An incident response plan ("Incident Response Plan") aligned with best practices articulated by the National Institute of Standards and Technology ("NIST") governs the Company's response to cybersecurity incidents. This Incident Response Plan outlines how the Company detects, analyzes, contains, eradicates, recovers, and performs post-incident activities in the event of a cybersecurity incident. It also contains an internal, risk-based escalation framework designed to ensure that all relevant individuals are promptly informed of any cybersecurity incident and dictates procedures for determining whether a cybersecurity incident is material without unreasonable delay.


text: MATERIAL EFFECTS FROM RISKS OF CYBERSECURITY THREATS While the Company experiences minor data and cybersecurity incidents from time to time, to the Company's knowledge, the risks posed by cybersecurity threats (including from such prior incidents) have not materially affected and are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. A successful cybersecurity attack may expose the Company and the Company's employees, customers, dealers, and suppliers to misuse of information or systems, the compromising of confidential information, manipulation or destruction of data, production downtimes, and operations disruptions. For example, the Company frequently operates in potentially dangerous environments with heavy machinery, such as steel mills, where a cybersecurity incident could cause a machinery malfunction that results in disruptions to operations or serious injury to employees. For more information, see risk factor related to the imposed risks from increased information technology security threats and computer crime under Strategic and Operational Risks in Part I. Item 1A. Risk Factors.


text: Role of Management The Company's Vice President, Chief Information Security Officer and Corporate IT, Giles Tipler, oversees the Company's IT security department and is responsible for assessing and managing cybersecurity risks and for leading the Company's response to cybersecurity incidents. Mr. Tipler has over 25 years of experience in information security, risk management, compliance, and information technology, with significant experience building cybersecurity programs across multiple countries in the Americas, Europe, the Middle East, Africa, and the Asia-Pacific regions. Mr. Tipler played an instrumental role in the development of the Company's Incident Response Plan and reports to the Company's Chief Financial Officer, Mr. Tom Vadaketh. Mr. Tipler is also responsible for providing quarterly updates to the Company's Audit Committee and Board of Directors regarding enterprise level risks, the effectiveness of the Company's cybersecurity program, and any material cybersecurity incidents that may arise.


text: Role of the Board of Directors The Board has delegated responsibility for overseeing the Company's cybersecurity and information technology processes to the Audit Committee. The Audit Committee is responsible for overseeing the implementation and effectiveness of the Company's processes and risk management protocols regarding cybersecurity and information technology, including risks from cybersecurity incidents and vulnerabilities and third-party service providers, and the steps taken by Mr. Tipler and the IT security department to inform themselves about and monitor the prevention, detection, mitigation, and remediation of such risks. Mr. Tipler reports to the Audit Committee regarding material cybersecurity incidents and any remediation efforts and is also responsible for providing quarterly updates regarding the overall effectiveness of the Company's cybersecurity program.


text: We rely on our technology infrastructure and information systems to interact with our clients, our employees, to sell our services, to utilize our data, to support and grow our client base, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors that we contract with, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems, and which may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include governmental actors or other actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: HARTE HANKS INC

ticker: HHS


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. Our Board of Directors, our internal Risk Steering Committee, in conjunction with our Chief Security Officer ("CSO"), have direct oversight of our management of cybersecurity risks.


text: Our CSO and the Risk Steering Committee ("RSC") oversees our enterprise risk management process. Under the direction and supervision of our CSO, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks, and an analysis of cybersecurity threats and incidents across the industry. The CSO and RSC review the results of the enterprise risk assessment in detail with management on a regular basis and reports its findings, as needed, to the Board of Directors.


text: Our CSO, reporting to our Interim Chief Operations Officer, and in conjunction with our IT Department, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our CSO has 3 decades of information technology and cybersecurity experience with the last 7 years leading the cybersecurity activities at Harte Hanks, as well as participating in numerous cyber readiness exercises with U.S. Government agencies, and has specialized training in cybersecurity risk management, cloud security and holds a CISSP certification offered by ISC2. Our CSO is also responsible for the operation of our cybersecurity program, and management of our cybersecurity incident response team.


text: As mentioned above, in response to the increasing threats presented by cyber incidents, in 2020 we established the RSC, which meets regularly. This committee is comprised of our Chief Security Officer, our Interim Chief Operations Officer, our General Counsel / Privacy Officer, our Head of Human Resources, each Director of Operations of each of our business units, and our Chief Financial Officer, as well as other key leaders. The RSC (in conjunction with the CSO), oversees activities related to monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The RSC, along with our CSO, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, and receives regular updates on cybersecurity-related matters.


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory yearly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our RSC also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The RSC escalates events, including the Interim Chief Operating Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Cybersecurity and Data Privacy Committee of the Board(the "Cybersecurity Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the Enterprise Risk Management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: HASBRO, INC.

ticker: HAS


text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting quarterly on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Cybersecurity Committee. Our Chief Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decade of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Cybersecurity Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Cybersecurity Committee meets regularly during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. A third-party cyber security firm also advises the Cybersecurity Committee on cybersecurity threats, trends in the industry, and best practices. This third party also evaluates and assesses our programs. The Cybersecurity Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.


text: The Board receives regular updates from the Cybersecurity Committee, including a summary of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.


text: We face a number of cybersecurity risks in connection with our business. During the past three years we have not suffered a material breach or a reportable incident, and cybersecurity risks (including breach of third parties with whom we work) have not materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A. Risk Factors.


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Audit Committee of the Board (the "Audit Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the members of an enterprise risk management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.


text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security ("CIS") Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, mitigation and continuous process improvements. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services, internal and external assessments, and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer ("CISO") and the Cybersecurity and Data Privacy Steering Committee are responsible for developing, implementing and evaluating our information security program. The CISO regularly reports on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Audit Committee. Our Chief Digital and Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decades of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests), tabletop exercises and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted critical applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee meets during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. The Audit Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection, prevention and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes to various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.


text: The Board receives regular updates from the Audit Committee, as well as from the Cybersecurity team, including a summary of key risk indicators, test results and related remediation, and recent threats and how the Company is managing those threats.


text: Hawkins is committed to maintaining robust cybersecurity practices to safeguard our operations, data, and stakeholders' interests. We monitor our cybersecurity landscape and adapt our strategies and governance practices to mitigate risks in this rapidly evolving area.

companyName: HAWKINS INC

ticker: HWKN


text: The Company acknowledges that cybersecurity threats present a risk of material adverse impacts on our operations, reputation, and financial condition. Cybersecurity threats are continuously evolving, becoming more sophisticated, and increasing in frequency. For Hawkins, these threats can potentially lead to data breaches, theft of intellectual property, operational disruptions, damage to persons and property, and financial losses. We have a comprehensive cybersecurity risk management strategy designed to promptly identify, assess, and mitigate the risk of occurrence and impact from cybersecurity threats. Despite our efforts, it is not possible to completely identify, prevent or mitigate the impacts of cybersecurity threats.


text: Cybersecurity Governance Our Board of Directors is primarily responsible for oversight of risks from cybersecurity threats. Our audit committee is specifically responsible for oversight of cybersecurity risks within the Board of Directors. The audit committee is informed of our cybersecurity risk management practices at regularly scheduled meetings, including: • Our cybersecurity policies and strategies. • Incident response and recovery plans. • Employee training and awareness programs. • Cybersecurity audits and engagement with external cybersecurity experts and advisors on an as-needed basis.


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. The CIO and senior network and security resources at Hawkins have decades of experience in cybersecurity practices and compliance. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is a separate component of our overall risk management process and is designed to protect our assets, including information technology systems, data, and operations, from cybersecurity threats. This involves: • Continuous monitoring and assessment of our cybersecurity posture. • Implementation of security measures such as firewalls, intrusion detection systems, and encryption. • Ongoing cybersecurity training and testing of our employees. • Regular cybersecurity assessments and penetration testing. • Vendor risk management to ensure third-party compliance with our cybersecurity standards.


text: We also maintain an incident response plan ("IRP") that outlines procedures for responding to cybersecurity incidents, minimizing their impact, and communicating with relevant stakeholders, including regulators, customers, and employees. During a cyber incident, our CIO and network security team assess the severity of the incident and notify key management and (if deemed necessary) our audit committee as promptly as practicable. Our incident plan is reviewed annually and updated as appropriate to address evolving threats and our business conditions.


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident and the risks presented by cybersecurity threats have not materially impacted our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. Our CIO has over 25 years of experience in the information technology field, including consulting on cybersecurity risks and mitigation in a variety of industries. He is a member of the local Infragard chapter and a regular speaker on cybersecurity topics at the Chlorine Institute. Additionally, the senior security and network engineering team has decades of experience in network and application security. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident, and the risks presented by cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.


text: The Company prioritizes cybersecurity as a strategic pillar integral to its business strategy, risk management, and governance frameworks. The Board of Directors and executive management play an active role in evaluating the effectiveness of our cybersecurity policies, practices, and procedures. Regular updates are provided by the Chief Information Officer to ensure cybersecurity risks are continuously monitored and addressed across all business functions. Our cybersecurity program incorporates policies, procedures, systems, and controls designed to safeguard the accessibility, confidentiality, and integrity of our data and systems. These processes are shaped by industry trends, and the evolving cybersecurity landscape.

companyName: HEICO CORP

ticker: HEI


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is an integral part of our overall risk management framework and is aligned with recognized industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber threats. Our program safeguards the confidentiality, integrity, and availability of our systems and data through a comprehensive and multi-layered approach.


text: We deploy robust controls, including firewalls, anti-malware systems, intrusion detection and prevention, encryption, and access controls. These measures are supplemented by continuous monitoring, vulnerability assessments, and penetration testing conducted both internally and by third-party assessors. Insights from these assessments inform the enhancement of our security controls and help us mitigate emerging threats effectively. We also actively engage with key consultants as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program.


text: We proactively monitor networks for suspicious activity and collaborate with governmental and industry partners to stay informed on emerging cybersecurity risks. We also emphasize a culture of vigilance through regular employee training that includes phishing awareness, malware prevention, and reporting protocols.


text: Governance and Oversight Our governance and oversight framework for cybersecurity risks operates at multiple levels within the organization. The Board of Directors has final oversight responsibility for cybersecurity-related matters and receives regular updates from the Chief Information Officer and senior management on the status of the cybersecurity program, vulnerability assessments, strategic initiatives, and any significant incident response activities.


text: The Chief Information Officer has over 27 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 20 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.


text: Cybersecurity Risks and Incidents We have experienced cybersecurity incidents in the ordinary course of business and recognize that such incidents are an inherent risk to any organization. While prior incidents have not materially impacted our business strategy, financial condition, or results of operations, we remain vigilant in anticipating and mitigating future threats.


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: The Chief Information Officer has over 28 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 21 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information regarding the potential impact of cybersecurity risks, please refer to the risk factor entitled "Cybersecurity events or other disruptions of our information technology systems could adversely affect our business" in Item 1A. Risk Factors.


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks. The cybersecurity program is part of our broader enterprise risk management program.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our information security leadership. These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.


text: Our Director of IT Governance and Response, who manages our cybersecurity program, is currently on leave and expects to retire from the Company in January 2025. During this time and until we appoint a new Director of IT Governance and Response, our Vice President - Information Technology ("VP-IT"), who has extensive cybersecurity knowledge and skills gained from 25 years of information technology work experience at the Company and elsewhere, has assumed responsibilities for this role with the assistance of a third party security leadership service. The VP-IT reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity risk and mitigation strategies.


text: Our cybersecurity and information technology teams actively maintain a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.


text: Cybersecurity Program Our cybersecurity program includes, among other things: • ongoing monitoring of systems for security threats at a base level • an internal team that focuses on higher level threats and conducts threat hunting activities • monitoring of the cyber threat landscape using a variety of sources, including engagement with domestic and international governmental security agencies, and industry groups • periodic engagement of third parties to test for vulnerabilities in our information technology systems, assess cybersecurity risk levels, and assess our cybersecurity policies and framework • compliance audits of our information technology processes by our internal audit team, which also monitors the progress of any remediation activities • employee training to raise awareness of cyber risks and behaviors that increase vulnerabilities • periodic exercises to test information technology security protocols • periodic exercises to test information security protocols to enhance crises management readiness and business continuity capabilities • systems and processes designed to assess, oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use • overseeing alignment with customer cybersecurity requirements • a Cybersecurity Incident Reporting process Cybersecurity Incident Reporting Process ("CIR Process")


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process includes: • cybersecurity incident prioritization • timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • procedures related to our Cyber Review Committee described below • a formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; General Counsel; Vice President – Investor Relations; Director – Risk Management & Insurance; and Director – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.


text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our Vice President & Global Chief Information Security Officer ("CISO"). These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third-party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.


text: Our CISO has over 20 years of experience in information security and global compliance. The CISO reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity, risk, mitigation strategies, and governance.


text: Our CISO oversees an internal cross-functional information technology governance, risk, and compliance team that actively maintains a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, CISO, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process include: • Cybersecurity incident prioritization • Timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • Procedures related to our Cyber Review Committee described below • A formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; CISO; general counsels; Vice President – Investor Relations; Director – Risk Management & Insurance; and Vice President – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HERSHEY CO

ticker: HSY


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.


text: The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company's incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting the Company's information technology. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: The Company engages external parties, including consultants, computer security firms and risk management and governance experts, to enhance its cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.