text: The cybersecurity committee receives periodic notices (written and verbal) from the Cybersecurity Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The cybersecurity committee also receives quarterly reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK

secItem: Item 1C


text: Our processes for assessing and identifying cybersecurity risks include regular network security assessments, vulnerability scans, penetration tests, and audits of our information systems, as well as monitoring and analysis of network activity and threat intelligence. We engage third-party service providers to assist us with some of these activities. We also have processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices.


text: Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team. COMSTOCK RESOURCES, INC.


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to a cyber incident. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future, which could result in: • Loss of or damage to our data, intellectual property, or other proprietary or confidential information; • Interruption or degradation of our operations, services, or systems availability; • Compromise or corruption of our data or systems integrity; • Reputational harm or loss of customer trust or confidence; • Legal liability, regulatory fines, penalties, or sanctions; • Remediation or mitigation costs, such as increased security expenditures, investigation expenses, or litigation fees; • Increased insurance premiums or difficulty in obtaining adequate insurance coverage; or • Other negative consequences. Any of these outcomes could have a material adverse effect on our business, financial condition, or results of operations.


text: The Audit Committee of our Board of Directors provides oversight over our cybersecurity risk management and strategy. The committee receives updates from our information technology management and external advisors on our cybersecurity posture, initiatives, and incidents on an annual or as needed basis. Our information technology department is responsible for assessing and managing our cybersecurity risks on a day-to-day basis and their processes for managing cybersecurity risks include implementing and maintaining security controls, policies, and procedures to protect our information systems and the information residing therein. They also provide periodic awareness notifications to our employees and contractors on cybersecurity best practices and their roles and responsibilities. In addition, we have established an incident response plan to coordinate our response to and recovery from any cybersecurity incidents. Our Director of Information Technology has over 20 years of experience in managing organizations in the energy and telecom industries. We also have a Certified Information Systems Security Professional, who has eight years of experience in cyber and information security.


text: In an era marked by rapid technological evolution, the business landscape is increasingly data-driven. Companies, including ours, collect, store, and leverage data to glean valuable insights about our members and travel trends; deliver relevant content to our members, suppliers, and business partners and enhance operational efficiency. This collection and leverage of data exposes us to potential cybersecurity threats. As a result, we have implemented a cybersecurity risk management framework that is designed to identify, assess, and mitigate risks from cybersecurity threats related to this data and systems and our business operations.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Risk Management Oversight and Governance The Board of Directors is responsible for overseeing risks related to cybersecurity and has delegated to the Audit Committee oversight over cybersecurity risks. The Audit Committee is responsible for reviewing and discussing with management the processes to identify, assess and manage cybersecurity threats, as well as to identify, assess and, to the extent required, disclose material cybersecurity threats.


text: Management is responsible for the day-to-day risk management process, including the identification of risks and implementation of policies and procedures designed to manage, mitigate or monitor cyber risks. In support of these responsibilities, management has designated a Chief Compliance Officer and formed a Compliance Committee to implement, manage and oversee a corporate compliance program.


text: The Compliance Committee is responsible for understanding the global risk landscape of the company and for working to ensure that we have a compliance program in place designed to mitigate, manage and/or monitor risks. The Compliance Committee consists of, among others, our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO") and Chief Compliance Officer ("CCO"). The CCO has established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of our Chief Information Security Officer ("CISO") and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with our information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our CISO reports to our CCO. The CCO reports to the Compliance Committee and the CLO. The CFO and CLO report directly to the company's Chief Executive Officer. Each of the CFO, CLO, CCO and CISO report regularly to our Board of Directors on, among other matters, our global risk landscape and risk management efforts, including those related to cybersecurity risks.


text: Our CISO has primary responsibility for managing our cybersecurity threat management program. The CISO is a Certified Information Security Systems Professional (CISSP), with more than 15 years of experience in building and leading information security teams and has worked at a variety of companies to implement and manage cybersecurity programs. Those entities have included large, publicly-traded companies. His experience includes developing and maintaining tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.


text: Our CISO leads an Information Security team that meets regularly. The CISO updates the executive management team on cybersecurity developments.


text: Our CISO meets at least annually with each of the Compliance Committee and the Audit Committee to discuss cybersecurity threats and the risk management programs. The CISO provides information, as appropriate, about the sources and nature of risks the Company faces and how management assesses such risks. Our CISO also provides a quarterly report to the Audit Committee on trends and observations concerning cyber threats and actions being taken to mitigate those risks. The Chair of the Audit Committee reports quarterly to the full Board of Directors and that report includes a summary of the CISO's report.


text: Processes for the Identification of Risks from Cybersecurity Threats The Compliance Committee, working with the CISO and the Information Security team, has developed a cybersecurity risk management program that aims to address the following key areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; • Approaches to mitigating and managing the material cybersecurity risks; and • A process for regular reporting to the Compliance Committee and Board of Directors (directly and through the Audit Committee).


text: The Company's risk assessment and mitigation program is centered on the following components: • Identification of material risks (primarily through enterprise risk assessments); • An evaluation of the likelihood of such risk occurring, the potential impact and the control strength, consideration for compensating controls to mitigate the risk; • Prioritization of different material risk items based on, among other things, the results of our evaluation; and • Establishment of a process for addressing those risks.


text: Our Internal Audit team reviews, monitors and audits various aspects of the Company's enterprise risk management program to evaluate whether risks, including cybersecurity risks, are appropriately identified and managed. Internal Audit periodically reports to the Audit Committee on the Company's cybersecurity risk mitigation efforts. The Audit Committee Chair, in turn, reports to the full Board of Directors.


text: We have several employee training and development programs that are designed to, among others, raise awareness of cybersecurity risks impacting the business to encourage consideration and facilitate managing those risks. To assess the effectiveness of our program, we periodically conduct penetration testing and other vulnerability analyses. As part of the assessment of the protections we have in place to mitigate risks, we engage third parties to conduct risk assessments on our systems.


text: Before purchasing third-party technology or other solutions and partnerships that involve exposure to the Company's assets and electronic information, our Information Security and Privacy team undertake due diligence to assess any key data privacy or information security risks.


text: For additional information about the cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Vice President of Information Technology, who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Vice President of Information Technology and representatives from Legal and/or Risk Management, as applicable.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Our Vice President of Information Technology and Director of Risk Management regularly evaluate the Company's cybersecurity risk profile and lead the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Vice President of Information Technology and Director of Risk Management each have approximately 25 years of experience in their respective fields, and our Vice President of Information Technology holds certifications in cybersecurity from accredited information technology certification providers.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Vice President of Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.


text: Risk Management and Strategy We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Vice President of Information Technology and Director of Risk Management to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework.


text: Our daily operations are monitored by a dedicated information technology team. We conduct monitoring of our computer networks, and have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive data, including through the use of encryption and authentication technologies. We assess the adequacy of our cybersecurity measures through annual penetration testing of our computer networks by external consultants, and we have performed tabletop simulations and drills at both a technical and management level around scenarios involving the loss of critical information and technology systems.


text: We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies, are evaluated to assess their performance across several domains, including data security and operations management. We seek to maintain effective communication with our third-party vendors to facilitate timely notification of cybersecurity incidents that might impact the Company.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased Information Technology ("IT") security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.


text: Autoliv maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats as an integrated part of the Company's overall operations. The objective is to provide protection against cybersecurity threats to our employees, operations, data, and products.

companyName: AUTOLIV INC

ticker: ALV


text: Cybersecurity risk management and strategy Cybersecurity risk management for the Company is undertaken both through dedicated cybersecurity risk management processes and within the Company's overall Enterprise Risk Management program, which is overseen by the Audit and Risk Committee of the Company's Board of Directors.


text: Autoliv has established an Enterprise Risk Management framework aligned to the ISO 31000:2019 to ensure that the context, principles, and processes for risk management are embedded and integrated with the operations of the company. All risks across the Autoliv risk universe, including cybersecurity, are assessed with bottom-up risk assessments and subsequently are aggregated and reported to the Audit and Risk Committee of the Company's Board of Directors.


text: Autoliv utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework in combination with other corresponding and partially mandated frameworks to guide cybersecurity risk management. This approach includes the identification, assessment, response, and management of risks arising from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our business, data and information systems. The Company contracts with third parties to assess Autoliv's cybersecurity program relative to its peers, utilizing the NIST framework as a baseline. Furthermore, Autoliv is pursuing, under TISAX (Trusted Information Security Assessment Exchange), an assessment and exchange mechanism for information security in the automotive industry, as well as compliance with road vehicle cybersecurity requirements as applicable to the supply chain under ISO 21434.


text: Frequent testing/auditing activities, bottom-up cybersecurity risk assessments, vulnerability scanning, monitoring of external threat intelligence and supplier risk sources, and 24/7 incident monitoring are executed by the cybersecurity function to inform our understanding of the cybersecurity risk landscape, including solutions from third-party service providers, and what areas of enhancement to prioritize. Further input is gained from regular maturity assessments executed by third parties as well as TISAX assessments executed by external audit bodies.


text: Autoliv combines expertise from our internal cybersecurity function with additional specialist capacities from external consultants and partners as may be from time to time. Separately, because we understand the risks associated with engaging third party vendors, such as service providers, consultants and partners, in our cybersecurity risk management processes, we conduct security assessments pre-engagement and monitor their work to mitigate any identified risks.


text: Autoliv has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. For a full discussion of these cybersecurity risks, please see our Risk Factors in Item 1A.


text: Management's Role The Chief Information Security Officer (CISO) is responsible for overseeing the Company's cybersecurity practices. Our CISO joined Autoliv in 2015. He has 29 years of information technology experience, including six years as CISO. The CISO reports directly to the CFO but, in line with the corporate governance model, the CISO's activities are formally governed through a management board, the "Digitalization and IT Management Board" ("DITM Board") comprised of the Chief Information Officer (CIO) and certain members of Autoliv's Executive Management Team ("EMT") representing engineering, supply chain management, operations and manufacturing, quality and project management, finance, information technology, and divisional teams. The DITM Board meets at least quarterly with cybersecurity as a standing agenda item. In addition to the standing DITM Board meetings, the CISO, when needs arise, meets with the full EMT typically at least semi-annually to report on, or discuss, specific cybersecurity-related topics.


text: The Cybersecurity function in Autoliv reports to the CISO. The cybersecurity function includes team members in all of the Company's divisions including technical security architects and incident response team members. The core team is supported by the broader organization with security coordinators in each plant and tech center and additional functional security experts as deemed relevant, such as in supply chain management and engineering. The function has the responsibility to operate day-to-day activities (e.g., testing, incident monitoring and response, vulnerability scanning and awareness training) as well as to drive prioritized improvements (as identified through the risk management processes), together with other relevant Autoliv functions and stakeholders. The security operations center ("SOC"), part of the Cybersecurity function, monitors Autoliv for cyber incidents 24/7. A documented incident response process and numerous documented playbooks provide the SOC guidance on how to respond for each type of incident, including categorization and principles for escalation. Incidents are escalated in the organization according to defined criteria to engage a level of authority that is deemed appropriate, such as the Corporate Crisis Management Team if necessary.


text: Board of Directors Oversight Our Board, in coordination with the Audit and Risk Committee, oversees the Company's Enterprise Risk Management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit and Risk Committee. Both the Board and the Audit and Risk Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks.


text: The Audit and Risk Committee receives information from the CISO and other members of management on at least a quarterly basis which is supplemented by a more extensive briefing from the CISO and management on at least a semi-annual basis on cybersecurity matters, including updates on cybersecurity training programs and the results of external assessments, as applicable. The CISO provides at least an annual briefing to the Board of Directors on these same topics.


text: The routine reporting to the Audit and Risk Committee and the Board includes as appropriate the highlights from the full spectrum of work done within the Company's cybersecurity program. The briefings by the CISO to the Audit and Risk Committee and Board also include the review of certifications and cybersecurity maturity assessments by management and third parties.


text: Our use of information systems for collecting, using, transmitting and storing data is a vital aspect of our business operations. Information systems are inherently vulnerable to a range of cybersecurity threats that could potentially have a material impact on our strategy, financial condition, liquidity or results of operations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Cybersecurity Risk Management and Strategy. The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk counsel, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.


text: Our approach encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. Identity and access management serves as an integral part of our strategy and involves access controls and authentication methods. Data protection and privacy practices, including data loss prevention, safeguards sensitive information. We also deploy cybersecurity systems, such as firewalls, intrusion detection systems and continuous monitoring, to provide defenses against unauthorized access. Incident response exercises are regularly performed to ensure readiness for potential cybersecurity incidents. Employee training and awareness programs are conducted to minimize risks associated with human error and foster a culture of security consciousness. Finally, vendor risk management practices are employed and focus on monitoring the posture of our third-party vendors to mitigate risks from external sources. In addition, we perform user access reviews for third-party applications, and for certain applications, obtain and review System and Organization Controls reports to assess our critical vendors' cybersecurity preparedness both at inception and on an ongoing basis.


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.


text: To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations.


text: Governance. Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. As part of this program, we have processes in place that are designed to assess, identify and manage material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") 800-53, including derivatives such as NIST Cybersecurity Framework ("CSF") and HITRUST, as well as NIST 800-66 and the Center for Internet Security ("CIS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.


text: We rely on a multidisciplinary team, including our information security organization, legal department, management, and third-party service providers, as described further below, to assess, identify, and manage cybersecurity threats and risks.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment, including monitoring and evaluating our threat environment and our risk profile; • a security governance council principally responsible for management's oversight of our IT security; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • a third-party risk management process for service providers, suppliers and vendors covering compliance and technical controls; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a cybersecurity incident response plan with established procedures for assessing and responding to cybersecurity incidents, and that includes having an experienced incident response firm on retainer.


text: For information on the Company's cybersecurity-related risks, see "Information Systems, Cybersecurity and Data Privacy Risks" in "Risk Factors" on page 46 of this Annual Report on Form 10-K. While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. Our Board of Directors has elected to exercise direct oversight over this area, rather than acting through one of its committees, given the increasing importance of cybersecurity matters and the cross-functional impacts of technology on our business. Our Board of Directors receives reports at least twice per year from members of senior management, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer, regarding the Company's information systems and technology and associated policies, processes, and practices for managing and mitigating cybersecurity and technology-related risks. Our Board of Directors also meets with external advisors to discuss technology and cybersecurity risks applicable to the Company and obtains perspectives which inform senior management's discussions with our Board of Directors. Our Board of Directors has delegated oversight of the process for determining disclosure required with respect to cybersecurity incidents to its Audit Committee.


text: At the management level, our information security organization is led by our CISO, who is responsible for cybersecurity risk management, with oversight by our Board of Directors. Our CISO has more than 20 years of experience in information security and IT risk management. He has specific experience in the following information security areas: security governance and policy, information security strategy and planning, penetration testing, vulnerability management, cybersecurity threat intelligence, incident response, third party risk management, cloud security, application security, identity and access management, data loss prevention, and security awareness.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security organization, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional (CISSP), Certified Data Privacy Solutions Engineer (CDPSE), or Security+ and through the use of technological tools and software and results from third-party audits. Our cybersecurity incident response framework is governed by a cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team comprised of our CISO, executive leaders, management and internal and external legal counsel, whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving certain incident response countermeasures and remediation actions; • Escalating incidents and response countermeasures for approval; and • Acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We have also established a security governance council (the "Council") to further strengthen our cybersecurity risk management activities across the Company. The Council includes our Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Secretary, Executive Vice President and Chief Operating Officer, Executive Vice President – National and Market Operations, Senior Vice President and Chief Information Officer, Vice President and Chief Information Security Officer, Vice President, Chief Compliance Officer, Vice President, People Services, and Associate Vice President, Internal Audit. The Council plans to meet quarterly beginning in 2024 and is responsible for management's oversight of our IT security in a cohesive and holistic manner that is designed to enable optimal decision-making.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President ("SVP"), Head of Finance and Investor Relations, Chief Legal Officer, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our SVP, Head of Finance and Investor Relations and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: A core aspect of the Company's business relies on technology and software; as a result, the security of those technologies and software, as well as the protection of the confidential information entrusted to the Company by its customers, are key components of the Company's business and strategy. DFIN maintains many processes for identifying, assessing and managing material risks from cybersecurity threats. These processes are applied throughout the organization and are monitored, updated and assessed. DFIN has developed cybersecurity risk management processes that are integrated into the Company's overall risk management system and designed to be comprehensive. Risk management committees such as the Enterprise Risk Management Committee and the Ethics and Compliance Committee regularly review the Company's policies and procedures governing cybersecurity. These policies and procedures inform protocols that align cybersecurity risk assessment and mitigation to evolving risks and threat vectors that impact broader enterprise risk categories, promoting a comprehensive approach. These processes include the identification, assessment and management of material risks that are derived from cybersecurity threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly proscribed and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and engages a consultant to periodically assess the Company's NIST CSF profile and maturity.


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats in real-time.


text: DFIN manages and continues to mature a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The processes also include evaluating existing suppliers and third parties for ongoing risk. The classification rating determines the frequency in which suppliers are evaluated. For example, those identified as critical suppliers are continuously monitored and assessed. Other supplier reviews occur on an annual basis or other cadence. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that were determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Minimization of cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2023, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and data handling and provided targeted cybersecurity threat awareness and training to executives during 2023. The Company conducts Incident Response tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response plans and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.


text: No material cybersecurity incident has been identified nor materially affected the Company's business strategy, results of operations, or financial condition during the periods covered by the Annual Report. The Company's goal is to continually assess potential incidents, enhance protocols, expand cyber risk capabilities to mitigate future risks and safeguard DFIN's intellectual property, operations and client data.


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management and either the Board or the Audit Committee. The Company's Chief Information Security Officer ("CISO") has over 29 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security, Identity Governance Administration and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ several tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.


text: The Board maintains oversight of risk from cybersecurity threats and is regularly briefed regarding emerging cyber risks, mitigation strategies and incident response protocols directly from the CISO. The Board includes at least one cybersecurity subject matter expert. The CISO periodically engages with the Board in an executive session to provide updates related to threat landscapes, security initiatives and other cybersecurity awareness within DFIN. The Board participates in tabletop exercises to better understand the Company's incident response planning and the Company maintains processes and procedures so that material risks or events are escalated and addressed appropriately.


text: We design and assess our program based on industry-standard frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), SOC2, ISO 27000, and ISO 27018. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Amplitude, Inc.

ticker: AMPL


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports and presentations from management on our cybersecurity risks and cyber risk management program. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 30 years in professional roles supporting and leading cybersecurity and cloud security programs for technology companies, including, (i) our Chief Information Security Officer (CISO), Dustin Pearce, who has previously led the Security and Governance, Risk, and Compliance (GRC) and Infrastructure functions, at Instacart and Slack, respectively, which included responsibility for assessing and managing various aspects of platform security for users, and (ii) our Executive Vice President of Engineering, Shadi Rostami, who has extensive experience in overseeing security for cloud services from an engineering perspective, including at Palo Alto Networks, while serving as Vice President of Engineering with responsibility for overseeing key cloud services, ensuring the security of cloud offerings and developing several cybersecurity solutions. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and our critical information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Our Manager uses the Center for Internet Security Critical Security Controls as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that our Manager meets any particular technical standards, specifications, or requirements.


text: Our Manager's cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, services, and our Manager's broader enterprise information technology ("IT") environment; • a team comprised of IT and Legal & Compliance personnel of our Manager principally responsible for directing (1) the cybersecurity risk assessment processes, (2) our Manager's security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes or those of our Manager; • cybersecurity awareness training of employees with access to our Manager's IT systems; • a cybersecurity incident response plan; and • a third-party risk assessment process for key service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses and limit our growth."


text: Cybersecurity Governance Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive and store. We have a cybersecurity risk management program in place designed to assess, identify and manage material risks from cybersecurity threats utilizing a defense-in-depth security strategy that integrates our staff, technology and operations to establish various securities barriers across multiple layers and missions of our operations. Our cybersecurity risk management program is designed to employ industry standard practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cybersecurity incidents, attacks and data breaches; cybersecurity preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key aspects of our cybersecurity risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, and a third-party continuous monitoring engagement, that monitors threat detection and response 24/7/365; • Utilization of third parties to assess our practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • Annual cybersecurity training for all employees, including social engineering (e.g., phishing, vishing, and smishing), privacy and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response and disaster recovery procedures, including quarterly tabletop incident response exercises, annual disaster recovery tests, annual unannounced penetration tests, annual phishing campaigns, and annual security control assessments; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • We engage an independent third-party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments. • We engage an independent third-party service provider to conduct an annual security program assessment of the controls, maturity and performance of our information security program and the information security risks associated with our technology and business systems. • We engage an independent third-party service provider to annually perform external and internal penetration and intrusion testing using industry standard tools and techniques. • We engage an independent third-party auditor to help ensure compliance with certain information security standards required under some of our federal contracts. • We have an established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts. These agencies conduct assessments of our controls on a periodic basis using the National Institute of Standards and Technology Cybersecurity Framework. • We engage a third-party auditor to review processes and procedures designed to control access to information systems as part of its Sarbanes-Oxley testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our cybersecurity risk management program. Further, our internal audit team conducts annual assessments of our cybersecurity risk management program and controls.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: We have a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure you that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program is integrated into our overall risk management system. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our cybersecurity risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's cybersecurity risk management program controls, including management's assessment of recent cybersecurity incidents meeting certain criteria.


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's cybersecurity risk management program controls meeting certain criteria.


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.


text: As mentioned above, our SIEM tool monitors threat detection and response 24/7/365. Identified threats are alerted and addressed by our information technology team in accordance with internal policies, industry standard practices and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed weekly and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Director, Information Security Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of cybersecurity incidents. They perform an impact assessment with respect to cybersecurity incidents meeting certain criteria and elevate the review of any such cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting a certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.


text: At a management level, our cybersecurity risk management program is led by our CIO, along with our Director, Information Security Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Director, Information Security Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These 11 technology professionals have an average cybersecurity tenure of 13 years and certifications from ISC2, ISACA, CompTIA and other industry certification leaders including CISSP, CISM, CISA, CCNA, CCNP, Network+, Security+, Project+, A+, CEH, CCSP and ITIL, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: Risk Management and Strategy In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and take a holistic approach to overseeing and managing cybersecurity, which is supported by both management and our Board of Directors. The Company's Board, the Audit Committee of the Board and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our approach to cybersecurity risk management is multi-layered and includes governance and risk, monitoring and incidence response, data security, application security, endpoint security, network security and perimeter security.

companyName: First American Financial Corp

ticker: FAF


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 13 years in various information security roles and has over 20 years of experience in the cybersecurity field.


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our CISO regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.


text: The Company maintains an extensive and structured enterprise risk management (ERM) program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective. The ISO Committee meets quarterly and is chaired by the Company's Chief Risk Officer and is comprised of the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Privacy Officer and top leaders of each of the Company's operating units. The Company's CISO, Chief Information Officer and Chief Technology Officer are also participants on the ISO Committee and the Chief Audit Executive, who reports to the Company's Audit Committee, is an observer. The CISO provides regular reports to the ISO Committee which are shared with the Company's Board of Directors.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls (SOC 2) testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training and compliance programs. Compliance with cybersecurity training is tracked and reported to the Company's Compliance Executive Steering Committee and the Audit Committee of the Board. In addition, the Company conducts quarterly employee phishing tests and our CISO provides those results to the Company's executives. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider (MSSP), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, as amended on December 29, 2023 and January 12, 2024. Prior to the Company's systems being taken offline in connection with this incident, we produced an internal forecast estimating our adjusted earnings per share to be $1.00. Our actual adjusted earnings per share was 69 cents, including a 5 cent tax benefit, implying a 36 cent shortfall relative to our internal estimate. Although the Company believes that most of this difference is related to the incident, the exact impact the incident had on our fourth quarter results is unknowable. Included in this 36 cent shortfall was $11 million of direct expenses related to the incident in our corporate segment including our $5 million insurance retention. We do not believe the incident will have a material impact on the Company's overall financial condition or its ongoing results of operations. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency. Our administrative and operating networks are targeted by hackers on a regular basis. Any failure, unexpected, or unauthorized use of technology systems could result in the unavailability of such systems, and could result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.


text: We mitigate cyber risk through trainings and exercises at all levels of the Company. Annual cyber and physical training and testing of employees are included in our enterprise security program. Our enterprise business continuity program facilitates business impact analysis of core functions for development of emergency operating plans and coordinates annual testing and training exercises. In addition, there are independent third party audits of our critical infrastructure security program and our business risk security controls.


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.


text: Risk Management and Strategy Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Board of Directors Oversight Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.


text: Cybersecurity Risk Management In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We also process anonymized information about participants in clinical trials involving certain of our product candidates. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."