text: Cybersecurity Risk While we have not experienced a material impact on our business strategy, results of operations or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws, which could have a material adverse effect on our business, results of operations and financial position.


text: We expect risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransomware attacks, other cyber-attacks, or other similar threats, to continue as events of this nature become more sophisticated and potentially more frequent, and the techniques used in such attacks change rapidly.

companyName: AZEK Co Inc.

secItem: Item 1C


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program that is an important and integrated part of our enterprise risk management function and is designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology cybersecurity framework, or the NIST Framework. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.


text: We deploy a number of safeguards and processes designed to identify cybersecurity risks and protect our information systems from cybersecurity threats. For example, we maintain data encryption, monitoring, data storage, identity / authentication controls, including two-factor authentication tools, and anti-malware and anti-virus solutions. Additionally, for providers of software-as-a-service and other services that hold or process our data, we review and assesses industry standard certifications provided by such third-party service providers. We perform periodic penetration tests to identify and address vulnerabilities and perform cyber simulations to practice our cybersecurity incident response procedures. We train employees on cybersecurity risks at least semi-annually and generate internal phishing campaigns to assess the effectiveness of the training. We also maintain written information technology and cybersecurity policies that are reviewed regularly and are available to employees on demand. In addition to internal resources and expertise across our information technology, internal legal and compliance and internal audit teams, we use a variety of industry standard security products and consultants and other third-party service providers to inform our understanding of the threat landscape and to assist us with protecting our technology infrastructure and data. Such security products cover data security, application security, endpoint security, and other security functions. We utilize third-party service providers to assist with the construction and maintenance of such defense system, as well as for assistance with respect to threat identification, response and, if necessary, remediation. We also engage third-party cybersecurity experts to conduct tabletop exercises to enhance incident response preparedness.


text: To the extent cybersecurity risks are identified, they are responded to by our cybersecurity team. Cybersecurity incidents are managed, evaluated, investigated, and responded to in accordance with our documented Cyber Incident Response Plan.


text: Cybersecurity Governance While management is responsible for our cybersecurity program and managing our cybersecurity risks, including our procedures and day-to-day operations, our audit committee oversees our enterprise risk assessment and management program, which includes oversight of cybersecurity risks. In performing its oversight responsibilities, our audit committee receives regular reports from, and meets with, our cybersecurity leaders at least semi-annually, to review our information technology and cybersecurity risk profile and to discuss our efforts to prevent, detect, mitigate, and remediate cybersecurity incidents. Our audit committee, in turn, regularly reports to the full board of directors regarding such oversight. When assessing audit committee membership, our board of directors considers each member's information technology and cybersecurity expertise. Our Cyber Incident Response Plan includes protocols under which cyber-related incidents are required to be escalated to senior management and to the audit committee, with ongoing updates regarding any such incident until it has been addressed. In addition to the above, we recently hired a Chief Digital and Technology Officer to oversee all aspects of our technology system infrastructure and processes and manage our team of internal information technology experts, including our Chief Information Officer. The Chief Digital and Technology Officer is supported by a management-level committee and an experienced cybersecurity team that support our processes to assess and manage cybersecurity risk. Each of our Chief Digital and Technology Officer and our Chief Information Officer has over 25 years of information technology experience, primarily in the manufacturing and consumer goods industries. Our Chief Information Officer also has a degree in Management Information Systems, and both our Chief Digital and Technology Officer and our Chief Information Officer have a Masters of Business Administration. We also currently engage a third-party consultant who reports directly to our Chief Information Officer and provides Chief Information Security Officer, or CISO, advisory services. This consultant has approximately 15 years of experience serving in cybersecurity leadership positions, including as a CISO at other U.S. publicly traded manufacturing companies.


text: The Company maintains a cybersecurity program, with direct oversight from senior management and the Board of Directors (the "Board"), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's cybersecurity program has been developed in light of the nature of the Company's business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company's business to broadly implement its cybersecurity program.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The Company's cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company routinely conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks and conducts at least one annual cybersecurity incident tabletop exercise to refine response plans.


text: A key element of the Company's strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company's information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company's servers and computers. The Company's cybersecurity preparedness program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee of the Board within 24 hours of their designation as high-risk by the Technology Risk Management Committee.


text: Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee of the Board as part of our overall risk management process.


text: The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on our Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors," under the heading "Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures."


text: Execution of the Company's cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has nearly 25 years of relevant experience in information security, including 13 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President of Information Systems & Informatics, and they meet periodically with senior leadership and the Board to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts. In addition, the Company's internal audit team conducts periodic audits of its systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.


text: The Company has also established a management-level Technology Risk Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company's Materiality Committee to support timely disclosure of relevant information.


text: Cybersecurity Risk Management and Strategy Inotiv's cybersecurity risk management framework is grounded in external standards, specifically those of the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). These guidelines provide a strong, structured foundation designed to systematically protect business operations, customer data, and intellectual property in an environment of rapidly evolving cyber threats. We deploy a multifaceted security strategy that includes multi-factor authentication (MFA), advanced malware defenses, and comprehensive endpoint protection supported by Extended Detection and Response (XDR) technology. Additionally, we leverage the expertise of a third-party provider of Managed XDR services, which provides continuous monitoring across our environment to respond swiftly to potential security events.

companyName: Inotiv, Inc.

ticker: NOTV


text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats. By staying aligned with industry standards and engaging expert resources, we continuously adapt Inotiv's cybersecurity practices to meet today's challenges and anticipate future risks.


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures.


text: Governance of Cybersecurity Management Our cybersecurity governance structure is specifically designed to provide a clear chain of responsibility and accountability for assessing, managing, and mitigating cybersecurity risks. The Vice President of Information Security, who reports directly to the Chief Technology Officer ("CTO"), a member of our Executive Committee, leads our cybersecurity initiatives. Together, the Vice President of Information Security and the CTO bring a combined 50 years of technology experience with over 20 years dedicated to IT and security leadership. The Vice President of Information Security is tasked with overseeing cybersecurity risk assessments, implementing strategic security initiatives, and ensuring alignment with evolving regulatory requirements. The Vice President of Information Security provides weekly briefings to the CTO. Additionally, the Vice President of Information Security presents updates to the Executive Committee and the Board of Directors at least annually, although these updates generally occur on a quarterly basis. These presentations cover critical security issues and significant emerging threats.


text: The Board of Directors, through its Audit Committee, is responsible for the oversight of Inotiv's cybersecurity risk management practices. The Audit Committee reviews and assesses our approach to risk management, including risk associated with cybersecurity, against industry standards and regulatory obligations. We believe this governance structure is integral to maintaining high-level visibility and accountability across all levels of leadership. By providing the Board of Directors with regular and detailed updates on cybersecurity initiatives and significant developments in the threat landscape, we foster transparency and maintain cybersecurity as a central priority within the organization.


text: The Board of Directors' involvement in cybersecurity governance underscores our commitment to safeguarding our operations and stakeholders from digital risks. With dedicated oversight from both executive leadership and the Board of Directors, we integrate cybersecurity into our risk management and governance frameworks.


text: To date, there have not been any previous cybersecurity incidents that materially affected, or are reasonably likely to materially affect, us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.


text: The Company has adopted the definitions present in 17 CFR 229.106 for the following cybersecurity terms: • Cybersecurity Incident: An unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through information systems that jeopardizes the confidentiality, integrity, or availability of information systems or any information residing therein. • Cybersecurity Threat: A cybersecurity threat as any potential unauthorized occurrence on or conducted through its information systems that may adversely affect the confidentiality, integrity, or availability of information systems or any information residing therein. • Information Systems: Electronic information resources owned or used by the organization, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support its operations.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats. These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our Information Systems and Data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents. • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:


text: The Company consistently identifies and evaluates cybersecurity threats that could significantly impact our business strategy, financial condition, and operational results. As of fiscal 2024 year-end, no significant cybersecurity threats or incidents have materially impacted our strategy or operational results.


text: The Board of Directors plays a crucial role in overseeing the Company's management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Transformation Officer, Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and the Company's response to significant incidents.


text: Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Transformation Officer, Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Transformation Officer has over 30 years of experience in extensive technology and executive leadership experience across diverse industries, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on the Company's cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of sensitive customer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: Risk Management and Strategy We assess, identify, and manage material risks related to potential cyber attacks on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, and misuse, and unauthorized access to, or other cyber attacks or vulnerabilities affecting, our data.


text: The assessment of cyber risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our enterprise risk management program. We strive to implement cyber policies, standards, processes, and controls for assessing, identifying, and managing material risks from cyber threats and responding to cyber attacks that are aligned with industry best practices.


text: We have an information technology team, led by our director of information technology, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with our senior management team. We seek to address cyber risks through a cross-functional approach, including relevant training for applicable employees and regular reviews and tests of our cybersecurity program that leverage work done by internal audit.


text: We use processes to oversee and identify material risks from cyber threats associated with our use of third-party technology and systems. We maintain processes to reduce the impact of a cyber attack at a third-party vendor. We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: See Item 1A—"Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Our board of directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. The Audit Committee oversees our overall enterprise risk management program and assists the entire board in fulfilling its oversight responsibility with respect to our information security and technology risks. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports to the entire board on our relevant strengths and opportunities.


text: The Audit Committee receives periodic updates from our director of information technology. These updates include matters such as ongoing changes in our external and internal cyber threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cyber and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness.


text: Management and Board Oversight In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company's risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: Risk Management and Strategy We rely on our information technology professionals at the subsidiary level to continuously monitor and update our information technology networks and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry-standard security technologies to protect the Company's and each subsidiary's data and business processes against cyber risks. To enhance our cybersecurity efforts and awareness, we have established an "IT Steering Committee," comprised of a team of information technology professionals from our subsidiaries, who will convene on a quarterly basis to discuss topics including cybersecurity threats, emerging attack methods, and best practices.


text: In fiscal year 2024, the Company engaged a consultant to conduct a cybersecurity risk assessment of our business operations at Live Ventures and each of our subsidiaries. This assessment evaluated both internal and external threats to operations and information handling. The output of this assessment offered a structured approach to understanding, assessing, and prioritizing our cybersecurity efforts. In collaboration with the Audit Committee, management will prioritize and implement appropriate measures.


text: As part of our cybersecurity risk management program, we will work with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.


text: While we are dedicated to cybersecurity, it is not possible to fully mitigate all technology risks. We are currently unaware of any cybersecurity incidents that have, or are reasonably likely to have, a material impact on our business or operations. However, the ever-evolving nature of attack techniques, along with the increased volume and sophistication of these attacks, means that cybersecurity threats - including data breaches, ransomware, and similar threats - could materially impact our future results. Such impacts could include reputational, competitive, operational, or other business harm, as well as financial costs and regulatory action. For further discussion of how risks from cybersecurity threats could materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A "Risk Factors," which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy We rely extensively on information technology ("IT") systems, including Internet sites, data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. These systems, like those used by most companies, may be vulnerable to a variety of disruptions, including, but not limited to, those caused by natural disasters, telecommunications failures, hackers, and other security issues. Moreover, these IT systems, like those used by most companies, are subject to the possibility of computer viruses or other malicious codes, and to security breaches, cyber incidents, ransomware attack or phishing-attacks. Cybersecurity is an integral part of risk management at our Company, and we maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, which is part of our overall risk management system and processes.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: We have installed and continually upgrade an array of protections against cyber-intrusions. Our cybersecurity risk management processes are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as various other regulatory requirements and industry-specific standards. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products and related services. These controls include multifactor authentication on all critical systems, firewalls, encryption, anti-virus protections, intrusion detection and prevention systems and identity management systems. We provide mandatory cybersecurity awareness training of threats to associates at least annually and routinely deploy simulated phishing tests to increase security awareness.


text: Our IT team regularly tests our controls through penetration testing, vulnerability scanning, internal compliance assessments, threat-hunting operations and attack simulation.


text: Additionally, in connection with our cybersecurity risk management processes, from time to time, we engage independent third parties to assess our cybersecurity program and to assist us with defining our cybersecurity strategy, uplifting our processes and aligning our objectives. Outside counsel has also advised the Board about legal obligations in managing cybersecurity issues and risks.


text: We maintain a cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across the Company. We also conduct "tabletop" exercises, including exercises facilitated by third parties, during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cybersecurity incident response plan. These exercises are conducted at both the technical level and senior management level and have included participation by members of our Board.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers, including through due diligence of such providers' cybersecurity practices, contractual obligations to operate their IT systems in accordance with certain cybersecurity standards and ongoing monitoring.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our Chief Technology Officer ("CTO") is responsible for assessing and managing our material risks from cybersecurity threats. We have also established a cross-functional Cyber Steering Committee, which includes our CTO, Chief Information Security Officer ("CISO"), General Counsel, certain business leaders on a rotating basis and representatives of human resources and communications. The CISO, supported by inputs from the CTO team leads, delivers quarterly updates to the Committee on key risks and overall security program posture, as well as monthly strategic updates to the CTO on high visibility and key action items. Our CTO regularly reports to our Board and the Audit Committee.


text: Our CTO has served in this role since 2023 and has over 25 years of experience in the technology industry. Prior to his current role, he served as the CTO of Tyson Foods and before arriving at Tyson, he was the Chief Information Officer at Hewlett Packard, and then CIO at Hewlett Packard Enterprise.


text: Board of Directors Our Audit Committee is responsible for the oversight of cybersecurity risks and receives a cybersecurity report from our CTO at least quarterly, and more often as needed, including in the event of a significant cybersecurity incident. The report includes information regarding the nature of threats, defense and detection capabilities, incident response plans and associate training activities. Our Board retains responsibility for the oversight of our overall risk management systems and processes and is briefed our CTO on cybersecurity risks on a quarterly basis.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.

companyName: Tesla, Inc.

ticker: TSLA


text: Our cybersecurity risk management program includes the following: • a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment; • the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • a cybersecurity incident response plan, business continuity plan, and established policies governing cybersecurity risk management at the corporate and property levels; • cybersecurity training for employees and key business partners with access to our systems; • a third-party cybersecurity risk management process for service providers and vendors who access our systems; • requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and • cybersecurity risk insurance. We also seek to engage reputable service providers that maintain cybersecurity programs or controls.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to functionally serve as a virtual chief information security officer ("CISO"), to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. This expert has experience having served as the chief information security officer for an international commercial real estate services company and currently serves as chief information security officer of a cybersecurity firm focused on commercial real estate. He is supported by an internal cross-functional management team of IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training and risk management efforts.


text: Our information security program is managed by a Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Cyber Security Steering Committee, which includes the Chief Executive Officer, Chief Financial Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is periodically evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Risk Management and Strategy We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation. We leverage the National Institute of Standards and Technology Cyber Security Framework 2.0 for measuring overall readiness to respond to cyber threats and the Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management program, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.


text: We perform response simulations, tabletop exercises and recovery tests on a quarterly basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides overall coordination of our response to a major cyber incident as well as a resource engagement plan. As part of our crisis management plan, our cyber crisis communication plan accounts for timely and accurate dissemination of information to stakeholders during the crisis. Other components of our crisis management plan are our business continuity plan, that documents the application of specific strategies and measures to enable core business activities to continue during a cyber event, and our disaster recovery plan, that is designed to restore data and systems to their operational state. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly.


text: With respect to third-party service providers, we perform assessments of their information security capabilities prior to entering into a contractual agreement. We also perform periodic information security capabilities reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, customer's data, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701), SOC 2, PCI DSS and HIPAA for our corporate and cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and external attack surface scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.


text: For a description of the risks from cybersecurity threats that may have a material effect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or VP of Cybersecurity Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last eight years, has been a chief information security officer for nine years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our Enterprise Cybersecurity Services ("ECS") team, led by our Chief Information Security Officer ("CISO"), has first line responsibility for our cybersecurity risk management processes. T he ECS team works in partnership with other internal teams to coordinate efforts, priorities and oversight. These include: our Cybersecurity Executive Council (the "Council"), which is composed of key leaders from stakeholder groups throughout the Company, including the CISO and certain members of senior management;

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" included Governance


text: Management's Role. Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk register and oversees the security awareness program.


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has over 20 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.


text: Risk Management and Strategy We manage risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, through our overall enterprise risk management process, which is overseen by our Board. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Marriott's policies, procedures, and processes generally follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with key third-party service providers, hotel owners, and other companies with whom we do business.


text: With respect to incident response, we maintain a Global Information Security & Privacy Incident Response Plan ("IRP"), which applies to information security incidents involving properties owned, leased, or managed by Marriott, as well as our above-property business locations. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.


text: For properties that are not owned, leased, or managed by Marriott, the franchisees, licensees, or other applicable counterparties are generally responsible for information security at such properties and the systems and business processes related to information security that are under their direction and control. Franchisees and licensees are typically required to comply with Marriott brand standards relating to information security, which include an obligation to report relevant information security incidents to us.


text: In the 2024 fourth quarter, we reached final resolutions with the FTC and the AG Offices in relation to the Data Security Incident. The resolutions with the FTC and the AG Offices include various ongoing requirements relating to our data privacy and information security programs.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. However, there can be no assurance that we, our hotel owners, our third-party service providers, or other companies with whom we do business, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. See the discussion about the Starwood Data Security Incident under the "Litigation, Claims, and Government Investigations" caption in Note 7 to our financial statements, the discussion of the same in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations," and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors."


text: Our Board has established a Technology and Information Security Oversight Committee ("TISOC") to assist the Board in providing oversight of matters pertaining to technology, information security, and privacy, including risks from cybersecurity threats; management's efforts to monitor and mitigate those risks; and significant cybersecurity incidents. The TISOC meets at least four times per year and typically receives reports from our Chief Information Security Officer ("CISO") and other members of management about these matters. The Board's Audit Committee receives reports regarding information security and technology-related audits conducted by our internal audit department. Risks from cybersecurity threats are also discussed with the full Board as part of regular legal updates and management presentations, the Board's oversight of enterprise risk management, and periodic education sessions.


text: To establish, implement, and evaluate our risk management policies and practices with respect to cybersecurity threats, and to facilitate the communication of such matters to the Board, the TISOC, and the Audit Committee, as applicable, we have established a number of management committees, several of which include senior leaders and direct reports of the Company's President and CEO, that serve as our policymaking and management-level governing bodies with respect to our information security and data privacy programs; oversee the implementation of our information security and data privacy risk management strategy; and identify, consider, and escalate information security and data privacy issues that may arise in our business.


text: Our global information security team led by our CISO works in coordination with these management committees and other cross-functional teams and is principally responsible for overseeing our information security strategy, working collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents when they arise. Our information security program is operated on a 24/7 basis to address risks from cybersecurity threats and to respond to cybersecurity incidents globally.


text: Our CISO and other members of senior management responsible for our information security program have extensive experience assessing and managing risks from cybersecurity threats, including decades of experience in information technology and information security positions; serving in information technology leadership positions at other large public companies; and having other significant experience in the areas of risk management, information technology, and information security. Our CISO has more than 27 years of experience in information technology and/or information security, including more than 13 years in such positions in the hospitality industry.


text: Risk Management and Strategy We manage cybersecurity risk through three core teams: cybersecurity engineering, data privacy, and a security operation center. These teams are responsible for overseeing data safety during new system and infrastructure deployments, maintaining appropriate cybersecurity controls, and monitoring, documenting and investigating any anomalies affecting employees, suppliers, and customers. Our IT security controls are designed to align with the NIST (National Institute of Standards and Technology) standards and are tested on an ongoing basis. These controls and procedures include processes that oversee and identify cybersecurity risks associated with third-party service providers that we engage, as described below. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. To support our internal risk management structure, we use third-party specialists to monitor for emerging threats, conduct vulnerability scans and analysis including simulated hacker attacks, and audit our cybersecurity framework. We also maintain an information security risk insurance policy in the event of a security breach. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: To our knowledge, LII's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats within the last three years, including as a result of previously identified cybersecurity incidents. However, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors."


text: Our Chief Technology Officer is ultimately responsible for overseeing all cybersecurity management, including the three core teams mentioned above, and reports to the Board of Directors twice a year on our cybersecurity tactical responses and strategic roadmap. The entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address enterprise risk management processes and policies.


text: At the management level, our Data Protection & Cybersecurity Steering Committee ("DPCSC") meets on a quarterly basis. The DPCSC includes representatives from communications, ethics and compliance, human resources, information technology, corporate audit, legal, risk, privacy, and sourcing. This committee is responsible for overseeing LII's data protection and cybersecurity policies and procedures. These cybersecurity policies and procedures include an IT security and privacy incident response plan to notify the appropriate parties, including our Chief Technology Officer, our Disclosure Committee, and our Board of Directors, in a timely manner.


text: Risk Management and Strategy We use a variety of processes to assess, identify, manage, and mitigate material risks from cybersecurity threats. Our cybersecurity risk management process has been integrated into the Company's overall Enterprise Risk Management framework as well as our Internal Audit plan. Our cybersecurity program regularly monitors external and internal threats to assess cybersecurity risk and engages in risk-based remediation. Our program is aligned to the Federal Financial Institutions Examination Council and other applicable industry standards. We conduct regular security awareness training, phishing exercises, and other security awareness programs to keep employees engaged and informed on ways to mitigate cybersecurity risk.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: The Company's Chief Information Security Officer ("CISO") is primarily responsible for developing, monitoring, and implementing our Information Security Program (the "ISP") and coordinating with relevant parts of our business. Our program is organized around six key functions: (1) security operations and incident response, (2) security engineering and architecture, (3) threat and vulnerability management, (4) information technology/information security – governance, risk and controls, (5) security awareness and training, and (6) identity and access management.


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our ISP team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments. Cybersecurity incidents are managed as part of our ISP.


text: The Risk and Compliance Committee of our Board of Directors (the "Board"), in consultation with and regular reporting to our full Board, oversees enterprise technology and its associated risks including cybersecurity. The Board and Risk and Compliance Committee regularly reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats on an annual basis. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, are reported to the Board and Risk and Compliance Committee in a timely manner.


text: As noted above, the Company's cybersecurity risk management process is integrated into our overall Enterprise Risk Management framework, which is overseen at the management level by senior leaders of the Company.


text: Our CISO, who has over twenty-five years of experience managing information security programs across banking and technology companies, is responsible for the Company's ISP and reports to our Chief Information Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with senior management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO provides quarterly reports and an annual report to the Board and the Risk and Compliance Committee on cybersecurity matters.


text: Management is accountable for our day to day risk management activities. With the assistance of our third-party IT and cybersecurity team, we employ a range of tools and services, including a governance, risk and compliance platform, to inform our managements' risk identification and assessment relating to our technology program. With this platform, we map our cybersecurity and risk management program to the Center for Internet Security ("CIS") framework.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Based on information known to us, we do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to "Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" and "If we or our tenants fail to adhere to applicable privacy and data security laws, this could have a material adverse effect on us or on our tenants' ability to meet their obligations to us" included "Item 1A, Risk Factors" of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.


text: Equinix Risk Management and Strategy Equinix has processes for assessing, identifying, and managing material risks from cybersecurity threats, both integrated into our Governance, Risk and Compliance Program (the "GRC Program") and existing within our Information Security function ("InfoSec") led by a Chief Information Security Officer ("CISO"). Our prior CISO departed Equinix in the fourth quarter of 2024, at which time we appointed a tenured Equinix Information Technology senior leader to the role in an interim capacity. To assist our interim CISO, we have engaged a technology risk consultant in an advisory role.

companyName: EQUINIX INC

ticker: EQIX


text: The foundation of risk oversight at Equinix is our Governance, Risk and Compliance Committee ("GRCC"), overseen by the Nominating and Governance Committee of our Board. The GRCC is a global, cross-functional group currently comprised of global senior leaders, across functions such as Legal, Compliance and Risk Management. The GRCC considers enterprise and emerging risks via Equinix's Enterprise Risk Management Program (the "ERM Program"). Our ERM Program focuses on the identification, assessment, management, monitoring and reporting of key business risks. Risk identification involves periodic risk surveys and/or risk interviews with key business process owners and executives to identify key strategic, operational, financial, regulatory, compliance and external risks at the enterprise level. Our next global risk assessment to identify enterprise risks will be conducted in the first half of 2025. In addition, the ERM Program also includes an Emerging Risks Team of business leaders at Equinix, representing a majority of business functions, that meets monthly to identify fast-moving, potentially impactful risks.


text: The GRCC prioritizes top enterprise and emerging risks for reporting to and dialoguing with our executive staff at least quarterly, and from this discussion, risks are presented to the Nominating and Governance Committee to consider for further assessment and report-out either to a committee or the full Board as appropriate.


text: The ERM Program works with risk owners to gather, evaluate, and prioritize risk information through the completion of a risk assessment and creation of a risk profile document. Top risks, including those related to cybersecurity, are evaluated through a detailed risk assessment, and the risks are reexamined periodically as needed. InfoSec performs an annual refresh of an information security risk profile document as required by this process, and the results of such assessment are reported out for escalation, prioritization and reporting on an annual basis.


text: Cybersecurity Risk Management and Strategy Equinix cybersecurity risk management activities and outcomes are guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and assessed by a third party. In addition, our cybersecurity program is certified globally against the International Organization for Standardization ("ISO") 27001 standards. Currently, our cybersecurity program includes the following key categories of security controls with many security capabilities serving under each category: Governance, Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Contingency Planning, Incident Response, Data Security, Continuous Monitoring, Maintenance Controls, Media Protection, Physical Protections, Risk Assessment, Third-Party Risk Management, System and Communications Projection, and System and Information Integrity.


text: Equinix does not generally engage any consultants, auditors, or other third parties in connection with processes for assessing, identifying and managing risks from cybersecurity threats other than the technology risk consultant identified above.


text: Information security risks have been deemed by our Board to be of critical importance to Equinix, and thus the Nominating and Governance Committee receives quarterly updates on cybersecurity and the full Board receives a briefing on cybersecurity at least annually. These briefings are conducted by our CISO and members of the InfoSec leadership team and cover topics such as key risk indicators, the status of strategic programs, operational updates and key initiatives, past and future action plans, and InfoSec functional updates.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Information Security Steering Committee ("ISSC") is a key element of our cybersecurity strategy. The ISSC is chaired by the CISO and comprises of a cross-functional group of senior leaders from various functions in the company. The ISSC aims to align our security and compliance programs with business objectives. Specifically, the ISSC (i) facilitates identification of risk-based priorities and trade-offs; (ii) aims to ensure economies of scale and consistency of information security and compliance across IT assets at the company; (iii) reviews and approves information security policies; (iv) reviews requests for policy and risk exceptions to provide a "Risk Acceptance Authorization"; and (v) serves as a communications channel and steward to cultivate a culture of trust across the enterprise.


text: Our interim CISO brings over 20 years of experience in information technology, which enables him to ensure alignment of our cybersecurity program with our critical infrastructure strategies. He has experience in implementing and operating a governance framework and core controls in information technology. Further, he oversaw the building of our application disaster recovery infrastructure for all production applications at Equinix, and since that time has been responsible for operating this infrastructure and ongoing disaster recovery testing. All of this experience is applicable and relevant to our cybersecurity program at Equinix. Additionally, team members supporting our program have relevant education and information security experience.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our management team, led by our chief information officer, who has 20 years of experience in information technology roles and supported by our director of information security, who holds several certifications in the field of information security and technology. In addition to our chief information officer, our internal management security committee includes our chief executive officer, chief financial officer, chief operations officer and chief legal officer, as well as others within our organization in information technology roles.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Risk Management and Strategy Hubbell recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, networks and technology assets. Cybersecurity related risks are included in the risk universe that our enterprise risk management program evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop mitigation plans, which are then tracked to completion. Cybersecurity related risks are also considered as part of our business continuity and resiliency planning. Business continuity plans establish risk management processes and procedures to mitigate interruptions to business activities, including from cybersecurity incidents.

companyName: HUBBELL INC

ticker: HUBB


text: Given the complexity and evolving nature of the cybersecurity threat landscape, Hubbell has a dedicated team of internal and external cybersecurity professionals, led by Hubbell's Chief Information Security Officer ("CISO"), that regularly monitor alerts and meet to discuss threat levels, trends, and remediation. We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. The engagement of third parties includes regular audits, threat assessments, and information system penetration tests. We also actively engage with key vendors, industry participants, legal counsel, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Hubbell further recognizes risks associated with the use of third-party service providers and has processes to identify material risks related to third parties. We conduct security assessments of third-party providers prior to their engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards. Our monitoring includes periodic assessments by the CISO and a team of cybersecurity professionals. Our cybersecurity risk management program is aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF).


text: Hubbell's Board of Directors (the " Board ") recognizes the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated oversight of risks associated with cybersecurity threats and has developed mechanisms to ensure effective oversight in managing such cybersecurity risks. The Audit Committee is composed of Board members with diverse expertise, including cybersecurity and technology, financial, and risk management experience.


text: Our cybersecurity risk management program also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so the Company can maintain a posture of continual enhancement of our cybersecurity management and strategy; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.

companyName: CORNING INC /NY

ticker: GLW


text: Cybersecurity Governance Corning's Board of Directors ("Board") plays a role in overseeing risks associated with cybersecurity threats. In particular, the IT Committee of the Board is responsible for cybersecurity governance and has information security oversight as a key component of its charter. In all meetings, the IT Committee reviews the Company's cybersecurity posture as well as significant cybersecurity events. Corning's Chief Digital and Information Officer ("CDIO"), in combination with Corning's CISO, briefs the IT Committee on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. On an annual basis, the CISO provides a cybersecurity update to the Board to review significant cybersecurity risks and their impact, if any, on internal controls. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures. Should a cybersecurity incident rise to the level of a corporate crisis, consistent with the Company's CCRT escalation protocols, the Board would be engaged.


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises, to inform our cybersecurity risk identification and assessment. We use third-party service providers to perform a variety of functions throughout our business, such as professional services firms and cybersecurity software providers. Depending on the nature of the services provided and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate certain cybersecurity incidents, as well as to comply with applicable reporting obligations.

companyName: AIR LEASE CORP

ticker: AL


text: For a description of the risks from cybersecurity threats that may materially affect us, including our business strategy, results of operations or financial condition, and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "A cyberattack could lead to a material disruption of our information technology ("IT") systems or the IT systems of our third-party providers and the loss of business information, which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs."


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk, including network segmentation, deployment of detection tools, and monitoring compliance with security standards. We conduct cybersecurity risk assessments (including in connection with our annual business risk assessment), penetration tests, purple team exercises, and data restoration testing and reviews through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various methods including the use of attestations and certifications of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The risk-based approach of the NIST Framework enables us to design and implement cybersecurity programs that are specific to our network architectures, customer environments, and institutional resources.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), develops and directs our information security strategy and policy, security engineering, operations and cyber threat detection and response.


text: Our CISO has 23 years of experience in cybersecurity and 17 years in cybersecurity management, received a Bachelor of Science in Management Information Systems and a Master of Business Administration from Rochester Institute of Technology, and is a Certified Information Systems Security Professional. Cybersecurity strategy and updates are reviewed by our executive leadership team on a monthly basis and are presented to other internal committees. The audit committee receives a regularly scheduled report on cybersecurity matters and related risk exposure from our CISO. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology (NIST); • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • conduct annual customer data handling and use requirements training for employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • through policy, practice and contract, as applicable, require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • leverage the NIST incident handling framework to help us govern, identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: As part of the above processes, we may engage with assessors, consultants, auditors and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, brand management, and other relevant matters.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who is responsible, along with his team, for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO has served in that role since 2021 and has been in cybersecurity related roles for more than 25 years, including with two publicly traded companies. Our Board of Directors has delegated oversight of risks from cybersecurity threats through our information security program to our Audit Committee, which receives updates twice a year on the program and on an as needed basis from our CISO regarding risks from cybersecurity threats. Our CISO additionally provides periodic updates to our Board of Directors, our Chief Executive Officer and other senior management members, including through our overall Enterprise Risk Management Program. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition over the long term. For additional information regarding cybersecurity-related risks we face, see "Risk Factors – Risks Related to Our Technology, Data and Intellectual Property – Cyberattacks, data incidents and breaches in the security (i) of our information systems and networks, (ii) of the products we sell and services we provide, and (iii) of the electronic and confidential information in our possession could materially adversely impact our financial condition, results of operations, reputation, and relationships with clients, partners, vendors, and teammates," in Part I, Item 1A of this report. INSIGHT ENTERPRISES, INC.


text: Risk Management and Strategy Processes for Assessing, Identifying, and Managing Cybersecurity Threats: The Company maintains a fully defined set of documentation for assessing, identifying, and managing material risks from cybersecurity threats. We recognize the risk that cybersecurity threats pose to our operations, and cybersecurity is an integral component of our overall enterprise risk management ("ERM") strategy. Our cybersecurity framework is aligned with the National Institute of Standards and Technology's special publication 800-53 and ISO 27001 and is comprised of the following four main pillars:

companyName: Vertiv Holdings Co

ticker: VRT


text: Risk Governance: The Company's cybersecurity program utilizes a cross-functional approach to addressing cybersecurity risks and engages in discussions with the Board (or a committee thereof) and our executive officers accordingly on an as-needed basis. The Company's cybersecurity processes are implemented to help ensure that the Company's cybersecurity practices are aligned with the Company's overall ERM standards and practices. The Company has formed a Cyber Risk Oversight Committee ("CROC") to oversee the Company's cybersecurity program. Our CROC, in turn, communicates any unresolved risks to the Company's Enterprise Risk Committee ("ERC") and the ERC interacts with the Board, the Audit Committee and executive management on a regular interval, or more frequently (if necessary) in regard to such risks. Currently, the CROC is comprised of representatives of our IT department as well as senior leadership, including a majority of the direct reports to our Chief Executive Officer ("CEO"). The ERC is comprised of our Chief Legal Counsel, Senior Director of Global Risk Oversight and various heads of regional or global business units and corporate functions, including but not limited to, IT, finance, accounting, legal, and human resources.


text: Risk Identification: We have developed risk identification and vulnerability management procedures that address the identification, prioritization, and remediation of cybersecurity vulnerabilities. To facilitate this program, the Company has created cyber risk and incident management procedures and a related risk register to document and monitor potential risks. As discussed below, the Company uses certain third-party tools to identify and manage cybersecurity vulnerabilities. Each risk in the risk register is monitored by one of our cybersecurity members and updates are reported to the CROC as needed.


text: Risk Assessment: The Company generally evaluates risks, including cybersecurity risks, based on probability, impact and proximity. As part of its program, the Company conducts formal cybersecurity risk assessment exercises on an annual basis. The Company has documented processes and protocols in order to delineate unacceptable levels of risk and assess such risks based on a number of factors.


text: Board Oversight of Risks from Cybersecurity Threats: The Board is ultimately responsible for the oversight of risks from cybersecurity threats and collaborates with the Audit Committee of the Board and the ERC in these oversight responsibilities. The responsibilities of the ERC include participating and collaboration with the CROC to oversee policies and management systems for cybersecurity matters, overseeing the identification, assessment and response to cybersecurity risks, maintaining and implementing our IRP, and communicating on a regular interval, or more frequently (if necessary) with the Board, the Audit Committee and executive management in regard to such risks. The Company's processes call for prompt and timely notifications and updates to the Board and the Audit Committee, as applicable and as necessary depending on the nature and severity of the incident, in connection with any cybersecurity incidents that may occur. In addition, the Board, the Audit Committee, and the ERC receive regular presentations and reports on cybersecurity matters that address the full range of cybersecurity topics discussed herein. Further, on a periodic basis, the Board and/or Audit Committee and the ERC also discuss our cybersecurity programs and processes with our CEO, Chief Information Officer ("CIO"), and Chief Information Security Officer ("CISO").


text: Management's Role in Assessing and Managing Cybersecurity Threats: Management's role in assessing and managing our material risks from cybersecurity threats is documented in the Company's IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of a majority of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents.


text: Relevant Expertise of Management: Our CISO has more than 20 years of intelligence, information technology and cybersecurity experience, and holds a Masters degree in the area of Cybersecurity and Information Sciences from The Pennsylvania State University as well as a Graduate Certificate from The Pennsylvania State University in Information Systems Cybersecurity and a current Certified Information Security Manager certification from ISACA. His prior roles include senior level positions in Defense, Financial Services and High Technology industries. Our CIO has more than 30 years of information technology and cybersecurity experience at various levels. She holds an executive MBA from the Quantic School of Business and Technology, a Graduate Certificate in SAP from Central Michigan University, a Masters in computer information systems from Grand Valley State University and a BA from the University of Michigan. Her prior roles include positions as Chief Information Officer and Vice President of Information Technology and Digital Office of Adient plc, a global automotive seating manufacturer, and Chief Information Officer and Vice President of Information Technology, Power Solutions of Johnson Controls.


text: To manage risks associated with third-party service providers, we typically require new vendors with access to our computing environment or access to confidential or sensitive data to undergo a risk assessment from our information security team. We conduct periodic reviews of these vendors to evaluate compliance with our cybersecurity policies. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of material cybersecurity in cidents, by virtue of the documents governing their relationship with us or applicable law.

companyName: FLUOR CORP

ticker: FLR


text: Our Audit Committee, which is responsible for oversight of cybersecurity risks, periodically reviews and discusses with management, including the Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"), risk issues associated with cybersecurity and policies and controls intended to mitigate those risks.