text: In addition, the Audit and Technology Committees of the Board coordinate on risk management oversight with respect to cybersecurity, including through quarterly joint meetings that cover the following topics: • Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan • Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items • Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity The Technology Committee of the Board oversees our information security program, including: • Reviewing with management our technology investments and infrastructure associated with risk management, including policies relating to information security, disaster recovery and business continuity • Receiving quarterly reports directly from our CISO, including updates on our enterprise cybersecurity threat level • Overseeing the engagement of outside advisors to review our cybersecurity program • Reviewing the results of our annual information security program maturity assessment performed by a third party • Reviewing the results of our annual security program risk assessment prepared by management Management Oversight of Cybersecurity Risk Our information security program is managed through implementation, monitoring and continuous improvement of the security program with active participation of management as described below. • Senior Leadership Team. The Equifax senior leadership team, consisting of our CEO and his direct reports ("SLT"), sets the tone for strategic growth, effective operations and risk mitigation at the management level. The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues. The SLT has overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax. • Chief Information Security Officer. Equifax has a CISO who is a member of the SLT and reports directly to our CEO. Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies. Our CISO is responsible for the assessment and management of material risks from cybersecurity threats, including oversight of the global Security team and the implementation and execution of the information security program. Our CISO helps ensure that the program is strategically aligned to Equifax's business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors. • Global Security Team. The Equifax global Security team is responsible for supporting the CISO in the execution of the information security program to meet the program's objectives. The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.


text: We maintain an Enterprise Risk Committee, composed of our Chief Financial Officer, General Counsel, Chief Information Officer and other members of senior management, which oversees the identification and management of corporate-level risks, including cybersecurity risk, using the COSO Enterprise Risk Management Framework. To support the identification of emerging risks and align our focus on our primary business risks, our Manager Enterprise Risk, whose job responsibilities are dedicated to enterprise risk management, surveys senior leaders at least annually to assess our most significant, or "Tier 1," enterprise risks. Based in part on this survey, our Enterprise Risk Committee assesses our most significant risks and considers the effectiveness of our risk mitigation efforts, and the Manager Enterprise Risk leads a presentation to our Board of Directors covering this information on an annual basis. Our Enterprise Risk Committee also oversees periodic follow-up assessments to analyze changes in existing, evolving and emerging risks and identify new or more effective measures for mitigation.

companyName: EQT Corp

ticker: EQT

secItem: Item 1C


text: Cybersecurity risk was classified as a Tier 1 enterprise risk for our company by our Enterprise Risk Committee for 2023. Our Manager Enterprise Risk, with oversight by our Enterprise Risk Committee, facilitates the monitoring of all Tier 1 enterprise risks within our digital work environment for changes in risk drivers and supports the evaluation of the potential impacts of each Tier 1 enterprise risk on our company, taking into consideration the effectiveness of our identified risk mitigants.


text: As part of its regular oversight role, our Board of Directors, with a primary focus on policy, oversight and strategic direction, oversees management's development and maintenance of the enterprise cybersecurity program and its actions to identify, assess, mitigate and remediate cybersecurity threats to our company. Our Board of Directors has delegated to its Audit Committee primary responsibility for regular oversight of cybersecurity risk at the Board-level and this delegation is reflected in the Audit Committee's Charter. Our Chief Information Officer provides a regular quarterly report to the Audit Committee of our Board of Directors regarding cybersecurity matters and our enterprise cybersecurity program.


text: Our management-level Enterprise Risk Committee has delegated to our Chief Information Officer primary responsibility for identifying, assessing and managing cybersecurity-related risks. Our Chief Information Officer has a Bachelor of Science in Computer Science from the University of Kentucky and a Master of Business Administration in Finance from the Wharton School of Business at the University of Pennsylvania. He has served in his current role at EQT since 2019 and has over twenty years of information technology experience within the energy industry.


text: Our Information Security team, led by our Vice President, Information Technology, who reports directly to our Chief Information Officer, manages our enterprise cybersecurity program and is responsible for managing all reported cybersecurity threats and addressing matters related to cybersecurity risk, information security and technology risk.


text: We maintain a Cybersecurity Incident Management Policy (Cybersecurity Policy), which provides guidance and processes for identifying, reporting, assessing, resolving and ensuring timely public disclosure, when appropriate, of cybersecurity threats, including both cybersecurity threats directed at our company and those associated with our use of third-party service providers. We have retained a leading cybersecurity incident response vendor to assist us in responding to cybersecurity incidents and we maintain relationships with integration vendors to help us recover or rebuild technology systems in the event of a large-scale cybersecurity incident.


text: Our Cybersecurity Policy requires that all of our employees, contractors and vendors report any suspected cybersecurity threat to our Information Security team using reporting functions within our digital work environment. Once reported, our Information Security team begins investigating the incident and assigns an alert classification to the incident, based on the perceived level of threat to our company and our technology network. The team updates the alert classification, as appropriate, throughout the incident response process.


text: In the event our Information Security team classifies a cybersecurity incident as posing a "critical risk," our Disclosure Committee, which includes our General Counsel and Chief Accounting Officer, is immediately notified of such classification via functions within our digital work environment. The Disclosure Committee, in consultation with our Information Security team and Chief Information Officer, engages in an assessment of the materiality of the cybersecurity incident, under applicable disclosure standards, including material developments throughout the incident response process. Our Board of Directors would be promptly informed upon identification of any material cybersecurity event.


text: Our Information Security team is responsible for managing all reported cybersecurity threats until final resolution. We maintain a record of reported cybersecurity incidents and the management and resolution of such incidents.


text: Our Information Security team, with support from our Legal Department, annually reviews our Cybersecurity Policy to ensure alignment with cybersecurity best practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, see Item 1A., "Risk Factors - Cyber incidents targeting our digital work environment or other technologies or energy infrastructure may adversely impact our operations."


text: We maintain a management-level Enterprise Risk Committee, composed of our Chief Financial Officer, Chief Legal and Policy Officer and other members of senior management, which oversees the identification and management of corporate-level risks, including cybersecurity risk, using the COSO Enterprise Risk Management Framework. To support the identification of emerging risks and align our focus on our primary business risks, our Manager Enterprise Risk, whose job responsibilities are dedicated to enterprise risk management, surveys senior leaders at least annually to assess our most significant, or "Tier 1," enterprise risks. Based in part on this survey, our Enterprise Risk Committee assesses our most significant risks and considers the effectiveness of our risk mitigation efforts, and the Manager Enterprise Risk leads a presentation to our Board of Directors covering this information on an annual basis. Our Enterprise Risk Committee also oversees periodic follow-up assessments to analyze changes in existing, evolving and emerging risks and identify new or more effective measures for mitigation.


text: Cybersecurity risk was classified as a Tier 1 enterprise risk for our Company by our Enterprise Risk Committee for 2024. Our Manager Enterprise Risk, with oversight by our Enterprise Risk Committee, facilitates the monitoring of all Tier 1 enterprise risks within our digital work environment for changes in risk drivers and supports the evaluation of the potential impacts of each Tier 1 enterprise risk on our Company, taking into consideration the effectiveness of our identified risk mitigants.


text: As part of its regular oversight role, our Board of Directors, with a primary focus on policy, oversight and strategic direction, oversees management's development and maintenance of the enterprise cybersecurity program and its actions to identify, assess, mitigate and remediate cybersecurity threats to our Company. Our Board of Directors has delegated to its Audit Committee (the Audit Committee) primary responsibility for regular oversight of cybersecurity risk at the Board-level and this delegation is reflected in the Audit Committee's Charter. Our Chief Information Officer provides a regular quarterly report to the Audit Committee regarding cybersecurity matters and our enterprise cybersecurity program.


text: Our Enterprise Risk Committee has delegated to our Chief Information Officer primary responsibility for identifying, assessing and managing cybersecurity-related risks. Our Chief Information Officer has a Bachelor of Science in Computer Science from the University of Kentucky and a Master of Business Administration in Finance from the Wharton School of Business at the University of Pennsylvania. He has served in his current role at EQT since 2019 and has over twenty years of information technology experience within the energy industry.


text: We maintain a Cybersecurity Incident Management Policy (Cybersecurity Policy), which provides guidance and processes for preventing, identifying, assessing, mitigating, resolving and ensuring timely public disclosure, when appropriate, of cybersecurity threats, including both cybersecurity threats directed at our Company and those associated with our use of third-party service providers. We have retained a leading cybersecurity incident response vendor to assist us in responding to cybersecurity incidents and we maintain relationships with technology providers to help us recover or rebuild technology systems in the event of a large-scale cybersecurity incident.


text: In the event our Information Security team classifies a cybersecurity incident as posing a "critical risk," our Disclosure Committee, which includes our Chief Legal and Policy Officer and Chief Accounting Officer, is immediately notified of such classification via functions within our digital work environment. The Disclosure Committee, in consultation with our Information Security team and Chief Information Officer, engages in an assessment of the materiality of the cybersecurity incident, under applicable disclosure standards, including material developments throughout the incident response process. Our Board of Directors would be promptly informed upon identification of any material cybersecurity event.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: KICO's Risk Management Committee, which is comprised of representatives of its technology team, assesses risks based on probability and potential impact on key business systems and processes. Risks that are considered high are incorporated into its overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Risk Management Committee and tracked as part of its overall risk management program overseen by the Corporate Sustainability and Risk Management Committee of our Board of Directors.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary.


text: Additionally, we require security training for all employees on a quarterly basis. The training covers a wide range of topics, including phishing, social engineering and data protection.


text: We assess and identify security risk to the organization by: • conducting assessments of risk, including likelihood and magnitude, from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology senior leadership, including the Chief Technology Officer; • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and • continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that we face, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A ( "Risk Factors – Our business could be adversely affected by a security breach or other attack involving our computer systems or those of one or more of our vendors.") in this Annual Report.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; • monitoring information systems to detect attacks and indicators of potential attacks; • identification of unauthorized use of the information system resources; and • deployment of monitoring devices strategically within the information system environme nt.


text: Our Corporate Sustainability and Risk Management Committee of the Board of Directors has been delegated the power and authority to oversee and make recommendations to the Board with regard to our overall approach to risks relating to business operations, including with regard to information technology and cybersecurity. In a presentation from our Chief Technology Officer, the committee received information regarding our approach to cybersecurity, which included the following topics: the confidentiality of nonpublic information and the integrity and security of our information system, the cybersecurity policies and procedures, material cybersecurity risks to us, and the overall effectiveness of our cybersecurity program.


text: The Board, in coordination with the Risk Committee, oversees the Company's risk management program, which includes risks arising from cybersecurity threats. DMC's Chief Information Officer (CIO) manages the Company's cybersecurity program and is responsible for leading and coordinating cybersecurity activities across the organization. The CIO reports directly to our Chief Executive Officer and has extensive information technology experience.

companyName: DMC Global Inc.

ticker: BOOM


text: Led by our CIO, we conduct regular assessments to identify potential cybersecurity risks and vulnerabilities, including the evaluation of systems and data assets. We have established internal procedures to stay vigilant against evolving threats by monitoring network traffic and conducting security audits. We also regularly engage independent assessors and external consultants who specialize in cybersecurity to conduct thorough, unbiased evaluations of our systems, policies, and procedures. These assessments help us ensure that our cybersecurity practices are aligned with applicable regulations and standards. To further evaluate our cybersecurity defenses, we periodically commission penetration exercises conducted by specialized firms. These tests simulate real-world attacks and assist in assessing our internal readiness and response capabilities.


text: We are proactively taking steps to enhance our monitoring of third-party service providers' cybersecurity, including the commencement of a vendor third-party risk management program. This program should better enable the Company to identify and manage material risks from cybersecurity threats related to our third-party service providers.


text: Cybersecurity risk updates are provided quarterly to our senior management team by the CIO as part of our enterprise risk management process. We have established an incident response policy that outlines the process for assessing and responding to cybersecurity incidents. The incident response policy is reviewed at least annually by executive management. The Board also receives quarterly updates on cybersecurity risks. These reports are typically presented by our CIO to the Risk Committee of the Board and include updates to recently completed cybersecurity initiatives, upcoming plans, an overview of current threats, as well as discussion of our overall cybersecurity maturity and readiness. The Board participates in simulated cybersecurity trainings and is kept apprised of changes in cybersecurity regulatory requirements, ensuring that our organization remains in compliance with relevant standards.


text: Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. See Item 1A. Risk Factors "A failure in our information technology systems or those of third parties, including those caused by security breaches, cyber-attacks or data protection failures, could disrupt our business, result in significant legal costs and other losses and damage our reputation" for a discussion of cybersecurity-related risks.


text: The Board, in coordination with the Risk Committee, oversees the Company's risk management program, which includes risks arising from cybersecurity threats. DMC's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), the management position responsible for assessing and managing material risks from cybersecurity threats, manages the Company's cybersecurity program and are responsible for leading and coordinating cybersecurity activities across the organization. The CIO reports directly to our Interim President and Chief Executive Officer, and the CISO reports directly to our CIO. Our CISO has extensive experience in cybersecurity, business continuity, disaster recovery and cloud security.


text: Led by our CIO and CISO, we conduct regular assessments to identify potential cybersecurity risks and vulnerabilities, including the evaluation of systems and data assets. We have established internal procedures to stay vigilant against evolving threats by monitoring network traffic and conducting security audits. We also regularly engage independent assessors and external consultants who specialize in cybersecurity to conduct thorough, unbiased evaluations of our systems, policies, and procedures. These assessments help us ensure that our cybersecurity practices are aligned with applicable regulations and standards. To further evaluate our cybersecurity defenses, we periodically commission penetration exercises conducted by specialized firms. These tests simulate real-world attacks and assist in assessing our internal readiness and response capabilities.


text: We are proactively taking steps to enhance our monitoring of third-party service providers' cybersecurity, including the continuance of a vendor third-party risk management program. As we continue to expand this program, it should better enable the Company to identify and manage material risks from cybersecurity threats related to our third-party service providers.


text: Cybersecurity risk updates are provided quarterly to our senior management team by the CIO and CISO as part of our enterprise risk management process. We have established an incident response policy that outlines the process for assessing and responding to cybersecurity incidents. The incident response policy is reviewed at least annually by executive management. The Board also receives quarterly updates on cybersecurity risks. These reports are typically presented by our CISO to the Risk Committee of the Board and include updates to recently completed cybersecurity initiatives, upcoming plans, an overview of current threats, as well as discussion of our overall cybersecurity maturity and readiness. The Board participates in simulated cybersecurity trainings and is kept apprised of changes in cybersecurity regulatory requirements, ensuring that our organization remains in compliance with relevant standards.


text: The Corporation recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the Corporation integrates cybersecurity risks into its overall enterprise risk management system. The Audit Committee oversees the Corporation's risk management approach and structure, which includes an annual review of the Corporation's cybersecurity program.

companyName: EXXON MOBIL CORP

ticker: XOM


text: The Corporation's cybersecurity program is managed by the Corporation's Vice President of IT, with support from cross-functional teams led by ExxonMobil information technology (IT) and operational technology (OT) cybersecurity operations managers (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: IT management provides regular reports to the Corporation's senior management throughout the year, and to the Audit Committee or the Board of Directors, as appropriate, in its annual cybersecurity review. Such reports typically address, among other things, the Corporation's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans as well as the evolving cybersecurity threat landscape.


text: The Corporation's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally across the Corporation and report cybersecurity incidents to appropriate levels of management, including senior management, and the Audit Committee or Board of Directors, based on potential impact. The Corporation conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, the Corporation exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The Corporation takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: As of the date of this report, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect the Corporation, including our business strategy, results of operations, or financial condition.


text: While the Corporation believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see "Item 1A. Risk Factors: Operational and Other Factors -- Cybersecurity" in this report.


text: The Corporation's cybersecurity program is managed by the Corporation's Vice President of Information Technology (IT), with support from cross-functional teams led by ExxonMobil IT and operational technology (OT) cybersecurity operations managers (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: The Corporation's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally across the Corporation and report cybersecurity incidents to appropriate levels of management, including senior management, and the Audit Committee or Board of Directors, based on potential impact. The Corporation conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, the Corporation exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate, and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The Corporation takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: While the Corporation believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see " Item 1A. Risk Factors: Operational and Other Factors -- Cybersecurity" in this report.


text: We understand the importance of cybersecurity in maintaining the confidentiality, integrity and availability of our systems and data. In order to protect against increasingly sophisticated cybersecurity threats, we have developed, implemented and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, including robust protocols for the assessment of information concerning material cybersecurity incidents and the disclosure of such information to investors. These risks are evaluated on an ongoing basis as part of our overall risk management strategy. As discussed in more detail below, we have policies and procedures in place to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats amongst employees, detect intrusions into our systems, and respond to cybersecurity incidents. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will timely identify or prevent every cybersecurity attack or incident.

companyName: FARMER BROTHERS CO

ticker: FARM


text: Risk Management and Strategy We have established processes for assessing, identifying, and managing material risks from cybersecurity threats and have integrated these cybersecurity processes into our overall risk management system. Specifically, we have adopted a cybersecurity framework which, where appropriate, aligns with the NIST's Cybersecurity Framework. Further, our systems, where appropriate, are PCI compliant under current standards.


text: We regularly review our Incident Response Plans to ensure readiness if and when an incident does occur. In the event of a cybersecurity incident, if a system does become non-operational, we maintain disaster recovery capabilities to return to normal operation in a timely manner.


text: Our cybersecurity processes to assess and identify cybersecurity risks include periodic risk assessments, deployment of security monitoring tools for continuous monitoring of our information systems, periodic testing for vulnerabilities in our systems, periodic testing of employees' cybersecurity awareness, and the dispatch of incident-specific cybersecurity alerts, among other procedures.


text: Our Information Security team evaluates cybersecurity risks and works to design and ensure implementation of appropriate controls and safeguards in alignment with our business objectives and operational needs. Management periodically reviews cybersecurity risks as part of the overall risks to the company as part of the enterprise risk management program. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: We engage various third parties to assess, test, or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including but not limited to: consultants who assist with assessing risks, support our PCI compliance assessments, assess our systems alignment with the NIST Cybersecurity Framework, and test and/or scan for vulnerabilities.


text: We rely on software, hardware, and network systems, including cloud-based technology, which are either developed by us or licensed from or maintained by third parties to maintain operations.


text: The Company's Director of Infrastructure & Security leads its cybersecurity program and reports to the Company's Vice President of Information Technology. The Director of Infrastructure & Security is responsible for management of cybersecurity risk and protection and defense of the Company's networks and systems. The Director of Infrastructure & Security manages a team of cybersecurity professionals with broad experience and expertise, including in incident response, forensics, threat intelligence, vulnerability management, and mitigation. The Company's cybersecurity team has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees, mechanisms to detect and monitor unusual network and endpoint activity, integrated threat intelligence and containment and incident response tools. The cybersecurity team also leverages multiple third-party security programs for full-time monitoring of security stacks and on-demand support to act as force multipliers in the event of severe or critical security events.


text: Both the Company's Director of Infrastructure & Security and Vice President of Information Technology have extensive cybersecurity knowledge and skills, with each possessing over 20 years of cybersecurity and related IT security experience. The Director of Infrastructure & Security and the Vice President of Information Technology each remain informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and risks, including through their regular review of reports prepared by the Company's Information Security team and the measures implemented by the Company to identify and mitigate cybersecurity risks and related threats.


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has primary responsibility to oversee risks from cybersecurity threats and has designated a specific Director, who possesses significant experience in information technology, as a special liaison (the "Technology Liaison") between management and the Board of Directors. The Board of Directors as a whole, or through the Technology Liaison, regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Technology Liaison receives quarterly updates from the Director of Infrastructure and Security and the Vice President of Information Technology relating to significant risks, cyber incidents, key performance indicators measuring the effectiveness of the Company's cybersecurity risk program and other relevant matters. The Technology Liaison regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Technology Liaison and the Board. In addition to the regular updates to the Technology Liaison, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Technology Liaison.


text: Board of Directors Our Board of Directors (the "Board") oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has primary responsibility to oversee risks from cybersecurity threats and has designated a specific director, who possesses significant experience in information technology as a special liaison (the "Technology Liaison") between management and the Board of Directors. The Board as a whole, or through the Technology Liaison, regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Technology Liaison receives quarterly updates from the Director of Infrastructure and Security and the Vice President of Information Technology relating to significant risks, cyber incidents, key performance indicators measuring the effectiveness of the Company's cybersecurity risk program and other relevant matters. The Technology Liaison regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Technology Liaison and the Board. In addition to the regular updates to the Technology Liaison, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Technology Liaison.


text: Risk Management and Strategy Our Board of Directors has delegated primary responsibility for oversight of cybersecurity risk management to the Audit, Finance & Risk Committee of the Board. The Committee receives quarterly reports from the Chief Information Security Officer (CISO) and Chief Risk Officer (CRO), respectively, and reviews them with such officers. These reports are made available to all board members concurrently. The CRO's report includes evaluation of the level of cybersecurity risks and strength of mitigating controls. All board members are invited to attend the portion of the Committee's meetings for review of reports received on risk management from management (e.g., the CRO, CISO, Chief Compliance Officer).

companyName: 1ST SOURCE CORP

ticker: SRCE


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are based on examination guidance published by the Federal Financial Institution Examination Council (FFIEC), an interagency body established under the Financial Institutions Regulatory and Interest Rate Control Act of 1978. Consistent with FFIEC guidance, 1st Source selected and adheres to the risk management framework established by the Cybersecurity Risk Institute known as the "CRI Profile." The CRI Profile is based primarily on the well-known National Institute of Standards and Technology's (NIST) "Framework for Improving Critical Infrastructure Cybersecurity" and is tailored to ensure expectations of financial institution regulators are met. Our processes are designed to meet standards for all seven CRI Profile functions – governance, identification, detection, protection, response, recovery, and supply chain dependency management. In addition, we adhere to security standards set by the PCI Security Standards Council which are designed to ensure secure payments globally.


text: Risks from cybersecurity threats, including risks identified from previous cybersecurity incidents, have required significant investments over time in maturing our Information Security Program and attracting and retaining the personnel with requisite experience and expertise. In particular, the CISO has substantial relevant expertise in the financial services industry and formal training in the areas of information security and cybersecurity risk management. We will need to continue to make meaningful investments in cybersecurity controls for continuous improvement and maturation in response to constantly evolving cybersecurity threats. Cybersecurity threats will continue to be endemic to the financial services industry for the foreseeable future.


text: Our Board and senior management oversee our processes for management of cybersecurity risks consistent with the foregoing standards. Such oversight includes regular reporting by management to the Board on the adequacy of such processes and potential material issues identified. Before escalation to the Board, issues are generally identified and assessed through our risk governance structure established under our Enterprise Risk Management Program. The risk governance structure includes three distinct components: management oversight, third-party professional assessment, and separate oversight and review by our Internal Audit Department. Management oversight is maintained through several committees that serve as forums for further assessment, remediation, and escalation. These management oversight committees include the Information Security Committee, co-chaired by the CISO and CRO, the Operational and Compliance Risk Committee, chaired by the CFO, vice chaired by the CISO and Chief Compliance Officer, the IT Steering Committee, chaired by the Chief Information Officer, the Enterprise Risk Management Committee, chaired by the CRO and the executive management committee known as the Strategic Deployment Committee, chaired by the CEO.


text: We regularly engage third-party assessors, consultants, and auditors to test and evaluate our controls for managing cybersecurity threats. These include third-party engagements by management and by our Internal Audit Department for (i) regular penetration testing of our cyber defenses, including an annual PCI-certified penetration test, (ii) third-party "health checks" on supporting technology, including our security incident and event management system (SIEM) and vulnerability management program, and (iii) third-party social engineering tests of the effectiveness of our employee training for detection of invasive attempts by malevolent actors. In addition, the Federal Reserve and DFI examine our control environment for managing cybersecurity risks each year.


text: Our risk governance structure includes a Third-Party Risk Management Program with first-level oversight by management's Third-Party Risk Management Committee and conforms to bank regulatory guidance. This program includes due diligence and periodic monitoring of the information security controls such providers have in place to protect our confidential data received, processed and/or stored by such providers.


text: The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."


text: Our Board and senior management oversee our processes for management of cybersecurity risks consistent with the foregoing standards. Such oversight includes regular reporting by management to the Board on the adequacy of such processes and potential material issues identified. Before escalation to the Board, issues are generally identified and assessed through our risk governance structure established under our Enterprise Risk Management Program. The risk governance structure includes three distinct components: management oversight, third-party professional assessment, and separate oversight and review by our Internal Audit Department. Management oversight is maintained through several committees that serve as forums for further assessment, remediation, and escalation. These management oversight committees include the Information Security Committee, co-chaired by the CISO and CRO, the Operational and Compliance Risk Committee, chaired by the CFO, vice chaired by the CISO and Chief Compliance Officer, the IT Steering Committee, chaired by the Chief Information Officer (CIO), the Enterprise Risk Management Committee, chaired by the CRO, the Data Governance Committee, chaired by the CIO, and the executive management committee known as the Strategic Deployment Committee, chaired by the CEO.


text: Risks from Cybersecurity Incidents We have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our business strategy, operations, or financial condition. The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."


text: Please see Item 7. "Managements's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Security" for discussion regarding the cyber security policies of the Company.

companyName: Federal Realty OP LP


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2023, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bancorp's Information Technology (IT) and Information Security (IS) teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management (IT CSRM) team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor, and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.


text: In light of the complexity and evolving nature of the cybersecurity landscape, the Bancorp periodically re-assesses the maturity of its cybersecurity programs, policies and procedures, including in some instances by engaging the assistance of external experts. The Bancorp also conducts exercises to test its incident response plans and threat assessments, some of which also involve assistance from external consultants.


text: The Bancorp also maintains a Third Party Risk Management Program to perform similar functions related to risks associated with the Bancorp's relationships with third parties. This assists the Bancorp in its management of its relationships with third parties, which includes considerations for identifying, analyzing and monitoring the cybersecurity risks that third parties may present to Fifth Third. The Bancorp also maintains a third-party incident response program to govern its response in the event of third-party cybersecurity events.


text: Board of Directors Oversight The Technology Committee of the Bancorp's Board of Directors takes primary responsibility for overseeing the Bancorp's information security programs at the Board level. The Technology Committee's primary purpose is to assist the Board of Directors in its oversight of plans and operations related to information technology, cybersecurity, data privacy and third-party technology strategy.


text: The Bancorp's Risk and Compliance Committee of the Board of Directors oversees the Bancorp's Enterprise Risk Management Framework and policies, including oversight of risks related to information security. The Risk and Compliance Committee receives periodic reports from the Technology Committee and these committees meet jointly at least once per year to discuss the Company's programs and risks.


text: The full Board of Directors receives reports from the Technology Committee and the Risk and Compliance Committee about the Bancorp's cybersecurity programs as a result of the above-described oversight. In the event of a material cybersecurity incident, the Bancorp's incident response procedures include notifications to the Technology Committee, Risk and Compliance Committee and full Board of Directors, when appropriate and necessary.


text: Management Oversight The Bancorp's Information Security Governance Committee (ISGC) is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer (CISO), Chief Information Officer, Chief Technology Officer, Chief Data Officer and Chief Operational Risk Officer.


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Information Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.


text: The CISO remains informed about developments in cybersecurity, including potential threats and emerging risk management techniques, reporting such information to the Chief Information Officer and Technology Committee periodically. The CISO implements and oversees processes for the regular monitoring of information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact of any incident, and long-term strategies for remediation and prevention of future incidents.


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2024, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and response processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bancorp's Information Technology ("IT") and Information Security ("IS") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management ("IT CSRM") team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.


text: Management Oversight The Bancorp's Information Security Governance Committee ("ISGC") is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer ("CISO"), Chief Information Officer, Chief Technology & Information Security Officer, Chief Data Officer and Chief Operational Risk Officer. The ISGC's membership enables the ISGC to be informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, if any, in accordance with the Bancorp's incident response plans.


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Technology & Information Security Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.


text: The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

companyName: US BANCORP \DE\

ticker: USB


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenge and recommendations for improvement.


text: The Company uses reporting and metrics frameworks and regular internal and external oversight to assess the health of the cybersecurity risk program. At the first level, the ISS team identifies, assesses, and manages cybersecurity risk and threats. The Company manages cybersecurity issues and findings through remediation and/or closure, with escalation processes if an issue or finding cannot be remediated within required timeframes. The Company engages external assessors, consultants, and auditors to review the Company's cybersecurity risk program against those of industry peers. The Company also uses consultants periodically to provide recommendations to improve and enhance the program. Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standards (PCI DSS), and other applicable standards, laws, and regulations.


text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. The Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Board's Risk Management Committee has a Cybersecurity and Technology Subcommittee that provides dedicated oversight to cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board typically holds an annual cybersecurity education session, which features the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level cybersecurity exercise to test its cyber incident response, completeness of playbooks, and communication protocols. This exercise involves Board members, managing committee members, third-party companies, and regulators as appropriate.


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard, which consists of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committee (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO, Timothy J. Held, has over 26 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: The Company's CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.


text: Venkatachari Dilip, the Company's Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.


text: The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company's Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company's regulators.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive.


text: Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: During the fiscal year ended December 31, 2023, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2023 Annual Report.


text: Risk Assessment and Management The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. Additionally, the Company's Information Security Awareness and Training Program educates employees and contractors on information security policies, standards, and practices to protect U.S. Bancorp's information, information systems, and processes. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenges and recommendations for improvement.


text: During the fiscal year ended December 31, 2024, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2024 Annual Report. The Company may not be successful in preventing or mitigating the impacts of a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: Third Party Risks The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. T he Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: Board of Directors Oversight As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Cybersecurity and Technology Subcommittee has oversight responsibility for cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board holds periodic cybersecurity education sessions, which may feature the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level crisis exercise that includes a cybersecurity component to test its resiliency response, completeness of playbooks, and communication protocols. This exercise involves Board members, Managing Committee members, third-party companies, and regulators, as appropriate.


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee, and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard consisting of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committees (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: Management Oversight The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. T he Company's CISO, Timothy J. Held, has over 27 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive. Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: The Cybersecurity Risk Management section within our 2023 MD&A (Item 7), beginning on page 86 of this report, is incorporated herein by reference.

companyName: FIRST HORIZON CORP

ticker: FHN


text: The Cybersecurity Risk Management section within our 2024 MD&A (Item 7), beginning on page 91 of this report, is incorporated herein by reference.


text: Cybersecurity Processes As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and continuously engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted. FMC frequently communicates with our third-party service providers to ensure timely notification of any matters that may impact our data security.

companyName: FMC CORP

ticker: FMC


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats. The most-recent audit was performed in 2022 over the Company's 2021 cybersecurity program. The audit results showed that FMC has a mature and robust cybersecurity program that is rated at or above peer industry benchmarks and also provided insight for areas of future improvement in risk mitigation and further program development.


text: Management Oversight in Cybersecurity Governance FMC's senior management Operating Committee, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, David Kotch, Vice President and Chief Information Officer, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's Operating Committee. He serves as a member of the Chemical Information Technology Center's CIO organization and the CIO Executive Summit. Mr. Kotch also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and Operating Committee are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management Operating Committee, including the Chief Information Officer, Chief Financial Officer, Chief Accounting Officer, and General Counsel will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2023, FMC did not directly experience a cybersecurity breach in any FMC system. During 2023, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.


text: Board of Directors Oversight in Cybersecurity Governance FMC's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which is comprised of independent directors whose prior work experience provides them with insights as to potential cybersecurity risks and mitigation strategies. Company executives along with external and internal cybersecurity experts update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic audits performed on the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. In addition to the routine updates provided to the Audit Committee, FMC has an established policy for communication of cybersecurity incidents with the Board of Directors and, if material, the investor community. Refer to the discussion above for further details of this policy.


text: Cybersecurity Processes As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. FMC performs a thorough security review prior to onboarding critical third-party providers, which includes review of third-party independent assessments in the form of SOC reports prior to contracting. SOC reports are also reviewed on an annual basis once the third-party is engaged. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted.


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats.


text: Management Oversight in Cybersecurity Governance FMC's senior management Executive Committee and Leadership Team, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, Jas Sidhu, Senior Director - Core IT, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's leadership team. He serves as a member of the Chemical Information Technology Center's CIO organization and the SAP Chemicals Advisory Board. Mr. Sidhu also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and other members of the Executive Committee and Leadership Team are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management, including the Chief Financial Officer, Chief Accounting Officer, and General Counsel, as well as the Senior Director - Core IT will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2024, FMC did not directly experience a cybersecurity breach in any FMC system. During 2024, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.