text: The Company's CISO is a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM), and is certified in Risk and Information Systems Control (CRISC). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.


text: The Company has not incurred material cybersecurity incidents over the past three years The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; • Formed partnership with Cybersecurity Infrastructure Security Agency (CISA), to monitor the Company's external traffic and external facing web environment; • Performed an internal red campaign; • Been audited by internal and external auditors.

companyName: Emergent BioSolutions Inc.

ticker: EBS

secItem: Item 1C


text: The ERM program and ERA process is described in the Company's Enterprise Risk Management Policy which was released this year. The program includes enterprise level risks grouped in 12 risk categories. Cybersecurity is included as a standing risk category. The ERM program does not itself independently review cybersecurity policies and practices. In first quarter 2024, ERM, in collaboration with Emergent's Policy and Training Center of Excellence, provided training on Emergent's Enterprise Risk Management Policy to all employees who are at the vice president level and above. As part of our ongoing Enterprise Risk Management ("ERM") enhancements, our ERM intranet page was launched in 2024 to centralize risk-related resources and policies. During the third quarter of 2024, a comprehensive reassessment of the Company's enterprise risks was conducted, with results thoroughly reviewed and communicated to executive leadership (VP and above) to align on key risks and strategic priorities. Annually, we provide an ERM training to all participants in advance of the Company's annual ERA. Full retraining on the ERM policy will occur every three years. The Company leverages the Committee of Sponsoring Organizations'("COSO") guidelines as the foundation for our ERM program and leverage external expertise.


text: The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics and incident response plan and conduct tabletop exercises. The Company engages outside consultants to review both its Cybersecurity posture, and maturity, and perform for a cyber assessments of the Company's manufacturing/operational technology environments. The Company has a process in place to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider, namely its Third-Party Risk Management Assessment Process. We utilize the NIST framework when assessing third parties. The framework covers 23 categories. When applicable, we may request if the third party vendor is SOC1/2, GDPR, certified. Additionally, the Company maintains a cybersecurity insurance policy to help mitigate the impacts of potential cybersecurity incidents.


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing and managing the Cybersecurity risks with comprehensive oversight of information security functions with an emphasis on strategic leadership, governance, risk management and technical proficiency. Moreover, the Company's CISO provides cybersecurity updates to the entire board of directors and the board's Quality Compliance Management Risk Committee (the "Committee"). The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities relating to the Company's compliance with laws, regulations, and industry standards that, if breached, may cause significant business, regulatory, or reputational damage to the Company, including oversight of the Company's: • Compliance with good ("x" = manufacturing, clinical, laboratory, pharmacovigilance, storage, distribution etc.) (GxP) and medical device Quality Systems Regulations (QSR); • Healthcare compliance, anti-corruption, privacy and data security landscape, medical product safety, supply chain, employee health and safety, political expenditures and lobbying activities, and government contracting; • Enterprise Risk Management program; and • Cyber and information security risks.


text: The Committee is the primary oversight body to monitor the Company's cybersecurity and related information technology risks and receives periodic updates from Company management (including, the Chief Information Officer and the CISO) on the Company's policies, processes, procedures, and any significant developments related to the identification, mitigation, and remediation of cybersecurity risks. The Chair or Vice-Chair of the Committee meet as necessary with the Chief Information Officer and the CISO to engage in a more detailed review of the Company's cybersecurity and information security activities. The Committee charter also requires that the Committee ensure that Company management provides an annual cyber and information security update to the Board of Directors. Current Committee members are: Zsolt Harsanyi, Ph. D., Sujata Dayal and Kathryn C. Zoon, Ph. D., all of whom are independent directors.


text: The Company's CISO is certified in Risk and Information Systems Control (CRISC) and Certified Information Privacy Professional/United States (CIPP/US). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.


text: The Company has not incurred material cybersecurity incidents over the past three years. The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; and • Performed an internal phishing campaign and awareness program.


text: Risk Management and Strategy Cyber risk management is a critical component of our risk management framework. Processes for assessing, identifying, and managing material risks arising from cybersecurity threats are integrated in our policies and procedures, including our enterprise risk appetite, risk assessment, risk treatment, risk acceptance or exceptions, and third party risk management policies.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: Our cybersecurity program ("Cybersecurity Program") provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans. We conduct annual cybersecurity risk assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.


text: Cybersecurity and data protection are important for the Company to maintain the trust of our customers, team members and stakeholders. Overseen by the Board of Directors and its Risk Committee, we regularly review, and as appropriate, adapt our Cybersecurity Program to an evolving landscape of emerging threats, evaluate effectiveness of key security controls, and assess cybersecurity best practices.


text: The Chief Information Security Officer ("CISO") and the Chief Technology Officer ("CTO") are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CISO reports to the Risk Committee and is responsible for implementing and maintaining our enterprise cybersecurity organization. The CISO will maintain an Incident Response Plan. The CISO ensures that the Incident Response Plan is tested annually and will present testing results to the Risk Committee. The CISO and/or its delegate will share applicable threat information to ensure Board members and staff are informed on the evolving threat environment. The CISO is responsible for ensuring the Board of Directors and staff are trained annually on cybersecurity and information security awareness. Additionally, the CISO ensures staff is adequately trained on Incident Response Plan procedures. The CISO will ensure security incidents are logged and maintained. The CTO provides our Cybersecurity Program with the technical and functional resources to achieve its strategic goals and objectives, and partners and collaborates with the CISO.


text: The Risk Committee is responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls. The CISO has regular and direct communication with the Risk Committee, providing a written cybersecurity report to the Risk Committee and a written cybersecurity report and briefing to the full Board on an annual basis (more frequently as necessary), in order to inform the Risk Committee of the state of the Company's Cybersecurity Program. These reports cover, but are not limited to, the Company's cybersecurity posture, overall status of the Company's compliance with the Cybersecurity Program, threat environment, material cybersecurity risks and events, Cybersecurity Program improvements and effectiveness, and other material matters related to the Cybersecurity Program.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: REMARK HOLDINGS, INC.

ticker: MARK


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. Such briefs include updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party CROs, CMOs, or other vendors, contractors or consultants.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our Head of IT and our executive management team.


text: Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident.


text: Third-Party Risk Management: We strive to proactively manage third-party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third-party systems and vendors. While we rely on third-party vendors to manage and maintain their own cybersecurity defense programs, we are developing a vendor risk management program to assess our exposure to these external cybersecurity risks.


text: Education and Awareness: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our cybersecurity program. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. These activities may be performed by external cybersecurity and application security professionals.


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.


text: Our Head of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Head of IT and the executive management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Our Head of IT has over 20 years of IT experience in the pharmaceutical industry and oversees the cybersecurity program at AnaptysBio. He has experience developing and leading cybersecurity programs for pharmaceutical companies, including experience in evaluating and implementing tools and technologies that enable defense and response capabilities and developing critical cybersecurity procedures and training and awareness programs.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material cybersecurity threats, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see Item 1A "Risk Factors."


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third party CROs, CMOs, or other vendors, contractors or consultants.


text: Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident. We use a manage, detection, and response (MDR) partner to provide threat detection and response capabilities. We also utilize security consultants including a vCISO to assess and continuously improve our cybersecurity program.


text: Third Party Risk Management: We strive to proactively manage third party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third party systems and vendors. Although we rely on third party vendors to manage and maintain their own cybersecurity defense programs, we continue to improve on our vendor risk management program to assess our exposure to these external cybersecurity risks, including the use of external security rating services and by evaluating vendor responses to our cybersecurity questionnaire.


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.


text: Cybersecurity Risk Management and Strategy Etsy recognizes the importance of information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property risks; harm to employees or members of our buyer and seller communities; violation of privacy or security laws; litigation or other legal risks; and reputational risks.

companyName: ETSY INC

ticker: ETSY


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.


text: We also would use similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers, including those who have access to our systems or our employee and other confidential data. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems, and data or facilities that house such systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks according to standards set by us and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.


text: We engage third-parties to conduct information security testing, including penetration testing, on our systems including our credit card payments infrastructure. In addition, our information security program is subject to periodic self-assessments that measure the maturity of our program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risks. Additionally, Internal Audit will from time to time review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting.


text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board and our Board Committees are actively engaged in the oversight of our information security program. Before the establishment of our Risk Oversight Committee, our Audit Committee assisted our Board of Directors with its oversight of risks associated with Etsy's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. In December 2023, our Board approved the formation of a Risk Oversight Committee to assist the Board with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks (which responsibility will move from the Audit Committee to the Risk Oversight Committee), as well as oversight of management's processes for effectively monitoring and mitigating risk.


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Our CTO holds a Bachelor's degree from RV College of Engineering in Bengaluru, India and a Master of Public Administration from Columbia University. Our CTO has been recognized as one of the Top 50 Women in Tech by the National Diversity Council and has received the Digital Diversity Network's Innovation and Inclusion CodeBreakers Award, Innovators & Disrupters Award from New York on Tech and Future CIO Award at Women in IT Awards. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist ("CIPT"). Our CISO held previous certifications include ISC2 Certified Information Systems Security Professional ("CISSP"), EC-Council Certified Chief Information Security Officer ("C|CISO"), and ISACA Certified Data Privacy Solutions Engineer ("CDPSE").


text: Given the importance of information security to our stakeholders, our Board or the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risk receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of the committee of our Board of Directors overseeing cyber-related risks and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of the Board or relevant committee.


text: Our Board also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to respond to, remediate, and resolve any cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.


text: We apply similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems and data and to facilities that house critical third-party systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks based on accepted industry standards and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the Risk Oversight Committee of our Board of Directors. Additionally, Internal Audit will annually review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting. We also do external testing, and in 2024 completed a NIST Cybersecurity Framework audit with Mandiant.


text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Our Board of Directors and our Risk Oversight Committee are actively engaged in the oversight of our information security program. Our Risk Oversight Committee assists our Board of Directors with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks, as well as oversight of management's processes for effectively monitoring and mitigating risk.


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are typically led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: On December 5, 2024, we announced that our CTO would cease serving as CTO effective December 31, 2024, and that we had initiated a search for her successor. In the interim, two current vice presidents of engineering, one of whom is our CISO, are providing interim leadership of our engineering organization. Our CISO is also primarily responsible for cybersecurity and risk-related matters in his capacity as interim Co-CTO, with assistance from our Senior Director of Information Security. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist. Our CISO previously held certifications include ISC2 Certified Information Systems Security Professional, EC-Council Certified Chief Information Security Officer, and ISACA Certified Data Privacy Solutions Engineer.


text: Given the importance of information security to our stakeholders, our Risk Oversight Committee receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of our Risk Oversight Committee and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of our Risk Oversight Committee.


text: Our Risk Oversight Committee provides a quarterly report to the Board of Directors on enterprise risk management matters overseen by that Committee, including cybersecurity-related matters. Our Board of Directors also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.


text: Our CIO has 19 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.

companyName: Owens Corning

ticker: OC


text: Our Vice President, Global Information Security has 27 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 21 years with Owens Corning, and reports directly to our CIO.


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for global information technology, including cybersecurity. Our Vice President, Global Information Security, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO is responsible for our information security organization, which is comprised of internal Owens Corning employees and external security suppliers. Our information security organization provides security monitoring and response and provides regular reports to our CIO and Vice President, Global Information Security. These regular reports inform our CIO and Vice President, Global Information Security as they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents under the oversight of the risk committee. Our Global Information Services team is regularly engaged in cybersecurity training and awareness and incorporates relevant reviews in technology design and development.


text: Our CIO has 20 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.


text: Our Vice President, Global Information Security has 28 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 22 years with Owens Corning, and reports directly to our CIO.


text: As part of its oversight of our company, our board of directors is involved in overseeing our risk management program. Cybersecurity is an important component of overall enterprise risk management ("ERM"). Our cybersecurity processes are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and industry standards and regulations, including the NYDFS Cybersecurity Regulation and PCI DSS. We address cybersecurity risks through an approach that focuses on preserving the confidentiality, integrity, and availability of our assets, including the information we collect and store, by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents as they occur.

companyName: TRUPANION, INC.

ticker: TRUP


text: Risk Management and Strategy Our cybersecurity risk management program focuses on the following key areas: • Technical Safeguards. We utilize technical safeguards that are designed to protect our assets from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, Managed Detection and Response, antimalware and access controls solutions, which we evaluate and improve through security assessments and threat intelligence. • Incident Response and Recovery Planning. We have established and maintained incident response and recovery plans that address how we respond to cybersecurity incidents, and we test and evaluate these plans on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including software and services vendors, Territory Partners and other external users of our systems and those of third parties that could adversely impact our business in the event of a cybersecurity incident. • Education. We provide regular, mandatory training for all team members regarding general security concepts, cybersecurity, and physical threats. The training is designed to equip team members to identify and properly respond to a variety of cybersecurity threats and risks, as well as to communicate our processes. • Governance. We maintain a management Risk Committee that assists with our ERM function. We also utilize a virtual Chief Information Security Officer ("vCISO") and other members of senior management and our IT team to support our risk management program. Our board of directors receives regular reports regarding our ERM function to support its oversight responsibilities, and we ensure our business units receive appropriate updates that may impact operations. • Collaboration. Our processes are designed to identify, prevent, and mitigate cybersecurity threats and incidents and provide for prompt escalation when appropriate. This approach is cross-functional, drawing on the skills and experiences of our diverse team, and it is designed to allow management to make timely decisions regarding public disclosure and business matters.


text: We periodically assess and test our cybersecurity processes. These efforts include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage independent third parties to assess our cybersecurity measures, including audits and reviews of our information security control environment and operating effectiveness. The results of such assessments are reported to management's Risk Committee and to our board of directors. We adjust our cybersecurity documentation, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Our board of directors, in coordination with our internal Risk Committee, oversees our ERM function, including the management of risks arising from cybersecurity threats. Our board of directors receives regular updates on cybersecurity matters from management's Risk Committee and from the Information Security Committee, which is comprised of Information Technology and Security leadership and oversees operational aspects of our cybersecurity program. Those updates to our board of directors address a wide range of topics that may include information on recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and information security considerations with respect to our partners and third parties. Our board of directors and management's Risk Committee also receive prompt information regarding any cybersecurity incident that meets established reporting thresholds and ongoing updates on any such incident until it has been addressed. Our Information Security Committee and vCISO annually report on the status of our cybersecurity program and meet with our board of directors to discuss our approach to cybersecurity and risk management.


text: Our Information Security Committee and vCISO, in coordination with management's Risk Committee, work collaboratively to implement a program designed to protect our assets from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, we deploy multidisciplinary teams to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management's Risk Committee when appropriate.


text: Our vCISO has served in various information technology, security, and privacy roles for over 25 years, including as the Chief Information Security Officer for several large public companies. Our vCISO holds undergraduate and graduate degrees in business administration and law, including specialties in information systems management and legal risk and compliance. Additionally, he has attained professional certifications in information security, auditing and assessment, and threat intelligence.


text: Cybersecurity threats, including those related to previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect us, our business strategy, operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: HIGHWATER ETHANOL LLC


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A - Risk Factors."


text: Cybersecurity Governance Our cybersecurity program addresses potential risks and implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from third-party providers that provide relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall risk management process, which is overseen by our Board of Directors. Our third-party providers provide regular data protection and cybersecurity reports to our senior management who then reports to the Audit Committee and the Board of Directors on a regular basis. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Our IT and related systems are critical to the efficient operation of our business and essential to our ability to perform day to day processes. We face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential or otherwise proprietary information, or that of our employees, via phishing/malware campaigns and other cyberattack methods.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our full Board of Directors. The Board meets with the senior executives, specifically the Chief Development Officer, Chief Executive Officer, and Executive Vice President of Finance on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities.


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.


text: Our Security Culture We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: • Designing, implementing and maintaining solutions with appropriate security controls; • Sustaining solutions with required patching and vulnerability remediation; • Creating and executing controls in support of policy as well as regulatory compliance; • Ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats; and • Delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.


text: We believe that the conduct of our employees is critical to the success of our information security. We keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes training intended to prevent the success of cyberattacks. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats.


text: We assess our service providers prior to allowing our information to be processed, stored or transmitted by third parties, and we include standardized contractual requirements in each contract where appropriate. We validate our service providers' security via questionnaires, open-source intelligence and, where appropriate, SOC 1 Type II reports on financially significant third-party service providers. Our process also includes regular monitoring of risk related to third parties on a periodic basis or when services or product purchases expand beyond their original scope or intended use.


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any known cybersecurity threats that have materially affected the Company.


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our Board of Directors. The Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board meets with the senior executives, specifically the Chief Executive Officer, and Chief Financial Officer on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities. The Audit Committee receives regular reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. Our Chief Executive Officer is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for preparing budgets, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Both executives have experience overseeing the information technology function and implementing and overseeing internal controls frameworks in our industry. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Cybersecurity risk management and strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, auditors, and other third parties, to among other things: monitor Company networks, servers and endpoints to identify vulnerabilities;


text: conduct bi-weekly email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;


text: obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans.


text: • Education and Awareness: The Company provides annual, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. If an employee fails a bi-weekly phishing campaign they are re-enrolled in the Company's cybersecurity awareness training.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration testing, adoption of an incident response plan, employee email phishing campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, employee cyber security awareness program, real-time (offsite) backups of production systems, regular audits and progress reports, and continuous improvement of the information security management system. The Company engages third parties, which it believes is the top of the market, to perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.


text: The Company's Vice President of IT, Randall Anderson, in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Management's Expertise Mr. Anderson holds a bachelor's degree in business administration with a focus on supply chain management and operations engineering from the University of Texas at Austin. He has served in various roles in information technology and information security for over 10 years, including as an IT business analyst with another publicly traded homebuilder where he was responsible for maintaining production data structures and system trainings. Mr. Anderson currently serves as a CyberUSA advisory board member where he regularly attends seminars given by cyber industry experts, including certain governmental agencies. Mr. Anderson is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence or a series of related unauthorized occurrences, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: conduct regular email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT, Randall Anderson, reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.


text: The Company's Vice President of IT in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains insurance coverage for potential breaches and a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We take a comprehensive approach to cybersecurity risk management. While securing the data customers and other stakeholders entrust to us is a top priority, we, like all companies, are subject to threats of breaches of our cybersecurity programs. Our board of directors (the "Board") and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: ServiceNow, Inc.

ticker: NOW


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against the NIST Cybersecurity Framework. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of material information security risks, including cybersecurity incidents and vulnerabilities. Our Audit Committee is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, third-party compliance certifications, control maturity assessments, and relevant ServiceNow, customer and industry cybersecurity incidents.


text: Management's Role The following individuals have primary responsibility for assessing and managing cybersecurity risks: • Chief customer officer ("CCO"), who oversees the digital transformation, digital technology and security functions • Chief digital information officer ("CDIO"), who oversees enterprise-wide digital transformation • Chief information security officer ("CISO"), who oversees the security function and reports to the CCO • Chief technology officer ("CTO"), who oversees product engineering and advanced technologies • General Counsel, who oversees the legal and compliance functions These individuals, among others, also serve as members of management's Security Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our CCO has served in various roles in information technology and information security for over 20 years, including serving as our Chief Information Officer ("CIO") and either the Chief Technology Officer or CIO of three other public companies. He holds an undergraduate degree in computer engineering. Our CDIO has served in various roles in information technology for over 20 years, including serving as our Senior Vice President of Digital Technology Experience and in similar senior roles at two other public companies. Our CISO has served in various roles in information technology and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies. He holds an undergraduate and master's degree in computer science. Our CTO has served in various roles in information technology for over 25 years and has been with us since 2011. Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large public technology companies.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we periodically practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We consult with external parties, such as third-party cybersecurity firms, to provide, among other things, monitoring of systems, threat intelligence, and employee cybersecurity training. We also use third parties to assist our risk management processes by conducting security assessments.


text: We have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also periodically audit cybersecurity practices of certain third-party service providers.


text: We employ a number of protective measures, including firewalls, anti-virus and endpoint detection and response technologies, regular annual training of employees with respect to cybersecurity and testing employee competence with anti-phishing policies followed up by additional remedial training as needed.


text: While there have been cyber incidents in the past, none of these incidents, individually or in aggregate, had a material adverse effect on our business strategy, operations, or financial conditions. Refer to "Risk factors" in Item 1A of this Form 10-K for additional information about cybersecurity-related risks.


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives updates relating to cybersecurity risk from management, including from our Director of Information Security. The Board also periodically receives reports on risks from cybersecurity threats from our Director of Information Security.


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from the Finance, Marketing, IT, Legal, Internal Audit, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Committee is also informed of our responses to such risks, incidents and threats.


text: Our cybersecurity incident response plan also contains mechanisms to notify executive management of cybersecurity incidents. As part of the plan, an executive-level leadership team may be activated and can act to direct our response efforts, to include mitigation and remediation activities, when appropriate.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. This includes processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.


text: We also have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also audit cybersecurity practices of certain third-party service providers, and take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data it processes on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards and evaluate them for additional information, product, and physical security requirements.


text: We employ a number of protective measures, including firewalls, endpoint detection and response technologies, regular annual training of employees with respect to cybersecurity and testing employee competence with anti-phishing policies followed up by additional remedial training as needed.


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee and the Board receive regular information security updates relating to cybersecurity risk from management, including from our Director of Information Security.


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from Finance, IT, Legal, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Cybersecurity Committee is also informed of our responses to such risks, incidents and threats.


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR ENERGY INC

ticker: CVI


text: Board Oversight of Cybersecurity Matters The Company's board of directors (the "Board") considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Company's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: The Board and Audit Committee are supported in their oversight capacity by the Company's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Company; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Company's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Likewise, the Company's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Company with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Company assets and information.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Company's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Company's use of third-party service providers who may have access to sensitive Company data and systems.


text: Material Impact on Company During 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Company's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Management also monitors AI usage and has implemented a framework that tracks use and is governed by the Company's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Material Impact on Company During 2024, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. These processes and response mechanisms are continually assessed for effectiveness, and any new security mechanisms, including several in 2024, are integrated when business needs arise or industry best practices shift.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We recognize the increasing importance of cybersecurity and its potential impact on our business operations, financial condition, and reputation. We are committed to protecting our information assets and have implemented a comprehensive cybersecurity risk management program to identify, assess, and mitigate cybersecurity risks. We have not experienced any material cybersecurity incidents in the last three years.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Board of Directors Oversight of Cybersecurity Our Board of Directors Audit Committee has ultimate oversight of cybersecurity risks. The Committee is composed of independent directors with cybersecurity expertise. Management briefs the Committee on cybersecurity and information security at least annually.