text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.


text: Our information security program, the framework for how we assess, identify and manage risks from information security and cybersecurity threats, is designed in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverages the International Organization for Standardization 27001 framework. Cybersecurity risk is integrated into our overall strategic risk management ("SRM") program, which evaluates key risk areas across Paramount by a cross-functional group of risk owners, in close coordination with members of senior management.

companyName: Paramount Global

secItem: Item 1C


text: Our information security program is overseen by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, the CISO and members of the information security team timely notify members of senior management, including our CTO and General Counsel, and under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and CISO, which include information on the broader information security and cybersecurity threat landscape, the information security program's strategic priorities, progress made in respect of those priorities and summaries of cybersecurity incidents and related remediation efforts. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. Our CISO has more than 20 years of experience managing information security for media/entertainment, technology, retail and financial services companies. While at Paramount, our CISO oversaw the integration of Viacom's and CBS's information security programs and our transformation to a cloud-centric, global streaming provider.


text: We have experienced cybersecurity attacks in the past and may experience attacks in the future, potentially with more frequency or sophistication. Although past attacks have not materially impacted our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors — Risks Relating to Business Continuity, Cybersecurity and Privacy and Data Protection."


text: Our information security program is overseen by our Chief Technology Officer ("CTO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers, partners and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, members of the information security team notify members of senior management as soon as reasonably practicable, including our CTO, Acting General Counsel and, under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and senior members of the information security team, which include information on cybersecurity incidents and related remediation efforts, the broader information security and cybersecurity threat landscape, the information security program's strategic priorities and progress made in respect of those priorities. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. The senior members of our information security team have extensive experience in technology and information security.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and managed through a multi-faceted approach including third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.

companyName: FAIR ISAAC CORP

ticker: FICO


text: We employ an experienced team of cybersecurity professionals with a variety of backgrounds. We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including: SOC 1, SOC 2 Type II, ISO 27001, CSA STAR Level 2, PCI-DSS and others.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Audit Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also makes available to clients attestations of its various certifications, audits, and penetration tests.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. Additional information on the cybersecurity risks that could materially affect us is discussed in Part I, Item 1A, "Risk Factors."


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and the Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents if and when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems it controls from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including any required public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board.


text: As part of its oversight of the Company's risk management noted above, the Audit Committee oversees, reviews and discusses with management the Company's risks from cybersecurity threats and management's role in assessing and managing such risks. The Audit Committee receives regular presentations, reports and updates from the CISO and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics.


text: The Company's processes also allow for the Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management at any time it deems appropriate to discuss matters relevant to the Audit Committee. The Company's policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: With an increasingly technology-driven business landscape, cybersecurity is critical to safeguarding our company's shipboard and shoreside assets and maintaining our operational integrity. We have implemented cybersecurity measures that are designed to protect the confidentiality, integrity and availability of our information technology and operational technology systems against the constantly evolving cyber threats.

companyName: CARNIVAL PLC

ticker: CUK


text: Our processes to identify and manage cybersecurity risks form part of our overall risk management framework which includes an organization wide, multi-layered approach to risk assessment and management. Our cybersecurity risk management program is designed to proactively identify, assess and mitigate potential cybersecurity threats. It leverages industry-leading cybersecurity frameworks and standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the ISO/IEC 27001 standard. We conduct regular risk assessments to evaluate the security posture of our systems and processes, including vulnerability assessments, penetration testing, external attack surface mitigations and monitor our network for suspicious activity and potential breaches. We engage third-party advisory firms to conduct assessments of the maturity of our cybersecurity program, including measures to improve our Payment Card Industry Data Security Standard ("PCI DSS") compliance, as well as to conduct penetration testing of our shoreside and shipboard assets on a periodic basis. We continue to invest in our information technology, operational technology and cybersecurity programs to layer in the right mix of risk-based controls to protect against evolving threats.


text: We maintain an incident response plan and related policies and protocols which outline procedures for identifying, reporting and responding to cybersecurity incidents. Our incident response plan is regularly updated to address new threats and tested through crisis simulation exercises involving our shipboard and shoreside employees. We also have an incident response team who is trained to handle a wide range of security events and collaborates with external cybersecurity experts when necessary.


text: We have data privacy and security standards across the company that are designed to comply with relevant regulations, including the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and PCI DSS. We employ encryption, access controls, and other data anonymization techniques to safeguard data throughout its lifecycle.


text: We also have data privacy and cybersecurity focused training for our shoreside and select shipboard team members. We regularly educate our shoreside and shipboard team members about the importance of handling and protecting guest and team member data, including phishing simulation exercises and annual privacy and security training to enhance awareness of how to detect and respond to cybersecurity threats.


text: Our cybersecurity diligence extends to third-party vendors and partners. We have operationalized processes that seek to identify and manage cybersecurity risks from our service providers, including those who have access to our guest or team member data or direct access to our network, systems and applications, with the goal of minimizing our exposure to third party risks. In addition, cybersecurity and data privacy considerations factor greatly in the sourcing, selection and oversight of our third-party service providers. We generally require third-party service providers that access or host our data, systems, or applications or could otherwise introduce cybersecurity risk to us, to complete additional risk assessments, comply with our security and privacy requirements, and agree to the timely reporting of cyber security incidents to us.


text: As of November 30, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. Despite our efforts with respect to protecting information technology operations and strengthening our cybersecurity and data privacy positions, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses incurred in connection with cybersecurity incidents were not material. For additional information on the risks from cybersecurity threats and the potential related impacts on the company, refer to Operational Risk Factor f.


text: Our Chief Information Security Officer ("CISO") leads our worldwide efforts in cybersecurity risk reduction and regulatory compliance. Our CISO oversees risk management across information technology operations, cybersecurity and data privacy. With over 20 years of experience across various industries, including Fortune 50 and 100 organizations, our CISO brings a comprehensive background in strategic cybersecurity leadership and risk management. This expertise is further supported by an array of certifications (C-CISO, CISSP, CISM, CRISC, CISA, and CIPT), as well as academic credentials, including a Master's in Information Systems from Harvard University and a Bachelor's in Business Administration from Florida International University. Our CISO regularly updates executive management and actively engages within the cybersecurity community to stay informed on the latest industry developments.


text: Our CISO chairs our Cybersecurity Advisory Council ("CAC"), a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The CAC is sponsored by our Chief Financial Officer and is composed of senior leaders from our brand information security, data privacy, legal, internal audit and information technology teams. The CAC meets at least quarterly and has responsibility for oversight of our cybersecurity strategic direction, risks and threats, priorities, resource allocation, capabilities and planning. The CISO and her team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our cyber incident response plan. Additionally, the CISO informs our Disclosure Committee on a quarterly basis, or more frequently if needed, of any cybersecurity risks or incidents or other information system matters that may affect our business strategy, results of operations or financial condition.


text: Our Chief Privacy Officer and Data Protection Officers oversee our focus on the proper processing of personal information in alignment with our privacy policy and applicable privacy laws and regulations.


text: The Audit Committees are responsible for oversight of our risk management with respect to information technology operations and cybersecurity while the Compliance Committees oversee risk management in the area of data privacy and the HESS Committees oversee risk management related to our maritime operational technologies. The Audit Committees receive updates from the CISO on our information technology operations, including cybersecurity developments and risks, three times a year, and our Board of Directors receive updates from the CISO on an annual basis.


text: Cybersecurity Risk Management and Strategy We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: FASTENAL CO

ticker: FAST


text: Our information technology (IT) security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes: • Enterprise security framework and cyber security standards; • Cyber security awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our IT security department maintains a playbook to respond to potential cybersecurity threats. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. Any identified risks are included in our overall risk management program, and internal and external auditors validate our IT controls on a regular basis.


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to all of our employees, which is tracked and recorded throughout the year. Results and progress are shared with Executive Leadership, the Audit Committee, and the Board. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training.


text: We have implemented an IT vendor risk management policy that provides guidance in managing risks associated with IT vendors and business partners. We have also established a third-party risk management program and conduct pre-onboarding security assessments and annual re-assessments of our service providers to collect, track, and manage third-party security controls based upon the risk presented to the business. Any issues identified during assessment are tracked through to remediation.


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, Information Technology, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and Enterprise Risk Management teams.


text: We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. The Information Security Risk Council, Executive Leadership, the Audit Committee, and the Board are notified of any material cybersecurity incidents through an established escalation process. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 28 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: Cybersecurity Risk Management and Strategy We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission.


text: Our IT security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our ISMS to support and promote resilient programs. This includes: • Enterprise security framework and cybersecurity standards; • Cybersecurity awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our Board and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, IT, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and ERM teams.


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 29 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, and the use of artificial intelligence by threat actors engaged in these activities, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. For additional information regarding cybersecurity threats, see 'Item 1A. Risk Factors' of this Form 10-K.


text: Risk Management and Strategy Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Enterprise Risk Management. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our Enterprise Risk Management ("ERM") program. Our ERM program, which is coordinated through our Enterprise Risk and Internal Audit function ("ERAS team"), includes the identification of risks relevant to Teradata's business, including material risks from cybersecurity threats; assigning personnel responsible for such risks; the development of strategies and plans to monitor, assess, and mitigate such risks; and oversight of the identified risks through regular reporting and risk evaluations with management, our Board, and/or relevant Board committee. Our ERAS team works closely with the Information Security function, including our Chief Information Security Officer ("CISO"), in the cybersecurity risk management process that informs the ERM program.


text: Cybersecurity Processes. The processes in place for managing cybersecurity threats, including threats associated with our use of third-party service providers, include identifying potential cybersecurity threats; defining the roles and responsibilities of our personnel pursuant to our Cybersecurity Incident Response Plan ("CIRP"); continuous testing and training of our employees on cybersecurity risks and security hygiene; communication and escalation protocols; and tools and technologies for incident detection and responses. We continuously assess risks and changes in the cybersecurity environment and adjust our processes and cybersecurity investments as appropriate.


text: • Our information security processes are built upon a foundation of advanced security technology, a trained team of security experts, and operations based on various global practices, standards, and frameworks, including the International Organization for Standardization, International Electrotechnical Commission, and National Institute of Standards and Technology Cybersecurity Framework. • We maintain policies, procedures, and controls that are designed to identify, protect, detect, respond to, and recover from information security and cybersecurity threats and incidents. Such items are reviewed, approved, and maintained by our CISO on an ongoing basis. In addition, we engage external advisors periodically to review and assess our policies, procedures, and controls. • Our CIRP provides a documented framework for handling cybersecurity incidents. The CIRP addresses cybersecurity incident detection, containment, analysis, eradication, recovery, escalation protocols, and coordination across multiple functions of the organization. • We have processes to manage cybersecurity risks associated with third-party service providers. Such providers are subject to information security assessments at the time of onboarding and at certain other times during their engagement with us. We require our providers to meet appropriate security requirements, controls, and responsibilities and comply with certain cybersecurity and data security standards that we have. We monitor compliance with these standards and investigate security incidents to take appropriate actions as necessary. However, despite the controls that we have in place, we also rely on our third-parties to implement security programs and we cannot ensure in all circumstances that their efforts will be successful. • We maintain an annual cybersecurity training plan including employee training on cybersecurity risks, requirements, and incident reporting. As part of our training plan, we regularly perform phishing tests of our employees. In addition, our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices. On an annual basis, our employees must complete cybersecurity awareness training. • We perform simulations and drills to review and test our information security program, including tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. • We maintain insurance to provide coverage for certain losses from cybersecurity threats and incidents. • We have developed business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and the loss of data and services from the effects of natural or man-made disasters to Teradata systems.


text: Cybersecurity Incidents. To protect our information systems from cybersecurity incidents and threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding materiality of the incident and any necessary public disclosure and reporting of such incidents can be made in a timely manner. In the last three fiscal years, we have not experienced any material cybersecurity incident and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted our results of operations and financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.


text: Cybersecurity Risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. See "Risk Factors — A cybersecurity incident, disruption, or failure of our information systems or those of our third-party providers could adversely impact our reputation, business, and financial results."


text: Board Oversight of Cybersecurity Risk. Our Board's role is to engage in informed oversight of enterprise-wide risks as managed through our ERM program, including cybersecurity. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee.


text: The Audit Committee is responsible for reviewing the adequacy and effectiveness of the Company's information security policies, the internal controls regarding information security and cybersecurity, and risks related to such exposures and actions taken to monitor and/or mitigate such risks. The Audit Committee receives quarterly reports as part of its meeting materials prepared by our CISO regarding the assessment of the status, adequacy, and effectiveness of our processes related to assessing, identifying, and managing cybersecurity risks and related mitigation plans. In addition, at least twice per year, the Audit Committee meeting agenda includes a presentation by the CISO to review and discuss the CISO's report on cybersecurity risks, mitigation plans and the steps the security team has taken to monitor and control related exposures. The Audit Committee reports to the Board on cybersecurity matters discussed at its meetings and the CISO's quarterly reports are provided to the Board as part of their meeting materials for their information as well.


text: Executive Oversight of Cybersecurity. Management is responsible for the Company's planning, identification, assessment, and mitigation of risks from cybersecurity threats. Our CISO, Chief Legal Officer, and Chief Financial Officer comprise our Core Cybersecurity Management Team (the "CCMT"). The CCMT has oversight of Teradata's CIRP and is informed and consulted on the response and resolution process for cybersecurity incidents. The CCMT is responsible for determining communications to inform relevant stakeholders of cybersecurity incidents as applicable, relevant, and/or required, including the Board; Audit Committee; the executive leadership team; investors; customers; employees; law enforcement; and regulators.


text: Depending on the nature and/or severity of the incident, additional stakeholders within the broader enterprise-wide management team may be included in the assessment, response, and resolution of an incident by the CCMT. The broader management team for this purpose may include, but is not limited to, executive and senior leaders in our Product, Customer, People, Information Technology, and Law functions, as well as others that may be considered necessary (collectively referred to as the "ECMT"). The ECMT provides oversight, perspective, and support from their respective areas of expertise to assist in analyzing the cybersecurity incident, materiality of the incident, and remediation considerations.


text: CISO and Cybersecurity Team. Our Information Security function is led by our CISO and is responsible for executing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: • The Information Security function consists of qualified professionals in cybersecurity. This team sets the cybersecurity strategy for Teradata; develops Teradata's cybersecurity architecture and deploys and manages tools and technologies aligned with such architecture to safeguard our information systems; manages the cybersecurity training required of our employees; monitors our cybersecurity threats and incidents; escalates the occurrence of cybersecurity incidents pursuant to the CIRP; and addresses and incorporates mitigation items. • The CISO appoints a Cybersecurity Incident Response Coordinator ("CIRC") to lead the management of cybersecurity incidents. The primary responsibilities of the CIRC include, but are not limited to: receiving and tracking all reported potential cybersecurity threats; escalating incident response;


text: determining relevant stakeholders of the Information Technology function and cybersecurity incident response team, which team is selected by CIRC to serve as the lead function for investigating and coordinating cybersecurity incidents;


text: alerting the applicable support functions of the potential cybersecurity threat and any defensive action that would be required; and alerting management, as applicable and necessary, of the potential cybersecurity threat. • Members of our Information Security function have broad ranges of qualifications and experience in information technology and security.


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO has a Bachelor of Science in Information Technology and an MBA.


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional ("CISSP") for general security practices, Certified Ethical Hacker ("CEH") for penetration testing capabilities, Certified Information Systems Auditor ("CISA") for information systems auditing, Certified Information Security Manager ("CISM") for overseeing enterprise security, Certified Risk and Information Systems Control ("CRISC") for risk management, and Certified Cloud Security Professional ("CCSP") for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO was also a founding member of the U.S. Department of Homeland Security and is a veteran who served in the United States Marine Corps. Our CISO has a Bachelor of Science in Information Technology and an MBA.


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional for general security practices, Certified Ethical Hacker for penetration testing capabilities, Certified Information Systems Auditor for information systems auditing, Certified Information Security Manager for overseeing enterprise security, Certified Risk and Information Systems Control for risk management, and Certified Cloud Security Professional for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.


text: We take an active role in ensuring the confidentiality, integrity, and availability of data, systems, processes, applications, and products. We are diligent when it comes to safeguarding the data of our strategic partners, employees, existing and future customers, and our teams throughout the globe. We take the protection of proprietary information, intellectual property, and sensitive information seriously, making it our commitment to provide comprehensive prevention, detection, and response capabilities, in order to maintain integrity.

companyName: CONMED Corp

ticker: CNMD


text: We manage cyber risk and assess internal maturity capabilities by leveraging the National Institute of Standards and Technology (NIST) framework, in conjunction with the Center for Internet Security (CIS) top 18 risk framework. Internal and external assessments are conducted for best practice benchmarking. Outputs from these assessments are used to develop strategic priorities, and to develop tactical action plans to continue to mature our cyber posture. CONMED leverages technologies, external consultants and vendors to support our risk management strategies, threat insights, trends, and mitigation approaches. In addition, CONMED has published corporate policies that support our cybersecurity efforts, such as our employee handbook, and has proactively implemented protection measures such as endpoint encryption, endpoint monitoring (EDR), remote access, VPN, and multi-factor authentication. Policies and procedures must go through a controlled review process by senior management to ensure relevant updates are being incorporated in our policies.


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our executive management team along with our Chief Information Security Officer (CISO) are responsible for managing cybersecurity risk, including assessing cyber maturity and development of short and long-term strategies. Our CISO has extensive leadership and experience within the cybersecurity space. We invest in the growth and development of our security team's expertise through hands-on training, technical industry certifications and security domain specific conferences. Security is approached as a unified company strategy, where everyone in the organization plays a key role in the success of our programs. Through required phishing training and awareness campaigns, policy and procedures training, and periodic multi-level tabletop exercise scenarios, we continue to improve identification, reporting, response, recovery, and prevention of threats. We engage in penetration testing, provided by external entities to ensure our internal processes and controls are validated.


text: We continue to invest in IT Security to improve technical capabilities, streamline response effectiveness, and harden preventive, detection, and response measures, while growing the core security organization to support business growth efforts.


text: We build our security program with the intent of a global reach and a global customer base at the top of our minds. Cybersecurity risk factors are evaluated, prioritized, and connected to annual strategic priorities. Strategic priorities are comprised of critical cybersecurity efforts in an ongoing effort to mitigate internal or external risks factors, and drive maturity objectives. We have developed and continue to develop strategic and tactical cyber capabilities to provide a modern approach to protecting the partnerships we have built our business around. This is, and will continue to be, an ongoing effort to provide and implement cyber best practices. Our Audit Committee is briefed semi-annually by our management team to provide awareness around IT environmental risk factors, cyber posture, global threat landscape, and changing regulatory requirements. Decisions are then made based on all assessed risk factors, including cyber maturity growth, strategic personnel, and appropriate cyber capability. All critical response activities are assessed and communicated from executive management to the Audit Committee which then reports to the Board of Directors.


text: During the fiscal year ended December 31, 2023 and through the date of the filing of this Form 10-K, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition.


text: During the fiscal year ended December 31, 2024 and through the date of the filing of this Form 10-K, we have not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, our business strategy, results of operations, or financial condition. The risk factors related to cybersecurity threats identified to be reasonably likely to affect, our business strategy, results of operations, or financial condition are included in "Item 1A. Risk Factors - Other Risks Related to Our Business".


text: Risk Management and Strategy Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets, assessing and prioritizing risks and employing various tools and techniques to identify and remediate threats. We also leverage third party service providers to test and validate our existing processes and procedures. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, our results of operations or our financial condition under the heading "We face risks associated with security breaches or cyberattacks" included as part of our risk factors disclosures in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: We have not experienced a cybersecurity incident which has been determined to be material and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the heads of the IT Security and Internal Audit departments on a regular basis, typically biannually. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks, also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal Officer, may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Information Security Management Steering Committee ("ISMS Committee"), comprised of our Chief Information Security Officer ("CISO"), as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, Cyber Incident Response Team and ISMS Committee to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO has significant experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.


text: Risk Management and Strategy The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital business solutions. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Identifying and assessing cybersecurity risk is fully integrated into our overall risk management systems and processes. The Company has established a cybersecurity and information security program that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. Our security program under this framework utilizes policies, software, training programs and hardware solutions to protect and monitor our environment, including multi-factor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing and identity management systems.


text: Our Chief Information Security Officer ("CISO"), who reports directly to the Chief Financial Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CISO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams, and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendors risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents. These include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee in responding to any such incidents.


text: Our cybersecurity and information security program also includes review and assessment by external, independent third-parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company has a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.


text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents, and use the findings to improve our practices, procedures, and technologies. In 2024, as part of upcoming enhancements to security preparedness, members of senior management are scheduled to participate in tabletop exercises led by third-party experts on cyber incident response best practices to apply their learnings to the Company's business continuity management program. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including the impact of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three years, we have not experienced any material information security breach incidents. The Company maintains cybersecurity insurance, and as part of management oversight we regularly review our policy and levels of coverage based on current risks.


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CISO who reports directly to our Chief Financial Officer. Our CISO has over 25 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CISO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CISO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CISO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.


text: Board of Directors Oversight Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The Audit and Finance Committee is charged with oversight of data privacy and cybersecurity risks. Our CISO provides updates to either the Audit and Finance Committee or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.


text: The CISO also promptly informs and updates the Board about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The Audit and Finance Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Board. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital technologies. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.


text: Our Chief Information Officer ("CIO"), who reports directly to the Chief Executive Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CIO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendor risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we undertake to prepare for, detect, respond to and recover from cybersecurity incidents. These activities include processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee ("AFC") of the Company's Board of Directors in responding to any such incidents.


text: Our cybersecurity and information security program also includes review and assessment by external, independent third parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company uses a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.


text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and conducts enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents and use the findings to improve our practices, procedures, and technologies. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CIO who reports directly to our Chief Executive Officer. Our CIO has over 20 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CIO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CIO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CIO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CIO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.


text: Board of Directors Oversight Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The AFC is charged with oversight of data privacy and cybersecurity risks. Our CIO provides updates to either the AFC or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.


text: The CIO also promptly informs and updates the Company's Board of Directors about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The AFC conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Company's Board of Directors. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our customer's business, cause us to lose customers and result in significant financial exposure and legal liability.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: These risks are identified, assessed and managed within the broader context of our ERM strategy, ensuring a comprehensive approach to organizational risk. We incorporate cybersecurity risk assessments into our overall enterprise risk assessment process. This integration ensures that cyber risks are evaluated and managed alongside other operational, financial, and strategic risks, offering a holistic view of our risk landscape. Our ERM strategy is overseen by an Enterprise Risk Management Committee, which is made up of representatives from our finance, legal, accounting, internal audit and global information systems functions, our business leaders and members of the Senior Leadership Team. It is led by our Chief Financial Officer and its actions are reported to our Board of Directors on a quarterly basis.


text: Our Chief Information Officer and Director of Information Security, along with members of their respective teams, are responsible for identifying and managing cybersecurity risk. The Senior Leadership Team, the Board of Directors and the Board's Audit Committee receive regular updates and engage in regular strategic discussions relating to cybersecurity risk management as part of their overall oversight of risk management.


text: Our cybersecurity framework leverages internationally recognized standards, including the CIS 20 and the NIST SP 800-171 frameworks, and is required to comply with the Department of Defense CMMC. We have policies and procedures in place designed to maintain compliance with relevant cybersecurity and data privacy laws and regulations in the jurisdictions in which we operate, such as the European Union GDPR and the California Consumer Privacy Act.


text: Our cybersecurity strategy includes policies, procedures, and technology that proactively safeguard our operations against cybersecurity threats. Internal teams and external experts regularly conduct risk assessments and audits to identify cybersecurity threats, ensure regulatory compliance, and adhere to control process best practices. Continuous monitoring of our networks and systems for threats and vulnerabilities is a key component of our strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats. We regularly review and update our cybersecurity strategies, policies and procedures, taking into consideration the latest advancements in cybersecurity practices and changes to the threat landscape.


text: We have a cybersecurity incident response and crisis management plan in place, which incorporates regular training and simulation exercises, including with senior management, to ensure readiness and efficacy in responding to cybersecurity incidents. Our incident response and crisis management plan coordinates the activities we will take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.


text: In addition, we provide regular security awareness education and training for all employees and consultants, conduct internal "phishing" testing and training for "clickers," require mandatory security training for all new hires and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: We engage qualified third-party cybersecurity experts for in-depth cyber risk assessments, penetration tests, and compliance audits, which provide impartial perspective and insight into our cybersecurity posture and we engage consultants for the development and refinement of our cybersecurity strategy and maturity, drawing upon industry best practices and regulatory knowledge. These collaborations also include the refinement of our incident response and crisis management plan and employee training, emphasizing the transfer of knowledge for sustainable in-house capabilities.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of these providers through surveys and reports, audits, and performance reviews.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Based on our review of past cybersecurity incidents, we believe that all such incidents were addressed promptly and effectively. In the last fiscal three years, we have not experienced any material information cybersecurity incidents and the expenses we have incurred from any cybersecurity incidents were immaterial. See Item 1A, "Risk Factors" of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Board of Directors The Board of Directors oversees our risk management processes, including with respect to cybersecurity risk, and the Board considers cybersecurity risk management an enterprise priority. The Board has delegated primary responsibility for reviewing and discussing with management our strategies, initiatives and policies relating to cybersecurity to the Audit Committee, which regularly reports to the full Board regarding such review and discussions. In addition, in connection with its oversight of cybersecurity risks in relation to financial reporting and internal controls, the Audit Committee plays a crucial role in the Board's understanding and management of the financial and operational impacts of cybersecurity risks.


text: As part of their oversight of cybersecurity risk, the Board and Audit Committee regularly review detailed cybersecurity reports, which include analyses of the threat landscape, recent incidents, and the efficacy of our cybersecurity strategy. In addition, the Chief Information Officer provides bi-annual updates to the Audit Committee and annual briefings to the full Board on our cybersecurity posture, strategy, and risk management. These reviews and updates are complemented by ongoing cybersecurity training for board members to enhance their decision-making and oversight effectiveness.


text: Regular active engagement in strategic discussions by the Board and Audit Committee ensures that cybersecurity considerations are effectively integrated into our overall business strategy and align with Company objectives and demonstrates the Board's commitment to proactive cybersecurity oversight.


text: Although the Board oversees our overall risk management, day-to-day management of cybersecurity risk is the responsibility of management. Management's critical role involves assessing and managing these risks through regular evaluations, deploying advanced security measures, and developing policies. Management integrates these strategies across all our operations, fostering a culture of cybersecurity awareness within the Company. This proactive stance is essential to safeguarding digital assets and ensuring operational resilience against evolving cyber threats.


text: Quarterly, the Chief Information Officer presents detailed cybersecurity reports to the Enterprise Risk Committee, focusing on strategic initiatives and evolving threats. The Enterprise Risk Committee, meeting quarterly, evaluates cybersecurity within the broader organizational risk context, ensuring consistent assessment and management.


text: The Chief Financial Officer chairs quarterly Enterprise Risk Management Committee meetings to review and evaluate various risk factors, including cybersecurity. The Chief Financial Officer's expertise in financial risk management, strategic planning, and organizational leadership is instrumental in guiding the committee's discussions and decisions. The Chief Financial Officer ensures that appropriate financial and operational implications of cybersecurity risk are considered and integrated into our Enterprise Risk Management Strategy.


text: The Chief Information Officer oversees our broader IT strategy, including cybersecurity, and presents quarterly to the Enterprise Risk Management Committee, bi-annually to the Audit Committee, and annually to the Board. The Chief Information Officer's expertise in information technology, cybersecurity, and strategic planning, forged over 24 years, 20 of which has been spent in leadership at global publicly traded companies, is integral to our approach to cybersecurity risk management. This expertise is crucial in aligning our cybersecurity initiatives with business objectives, ensuring that our strategies effectively support the Company's overall goals.


text: The Director of Information Security, reporting to and collaborating with the Vice President of Information Technology & the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security Director plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.


text: Regular reporting channels between the Director of Information Security, the Chief Information Officer, and the Chief Financial Officer facilitate a cohesive, well-informed approach to managing cybersecurity risks. These reports include detailed analyses of potential threats, incident response readiness, and the effectiveness of existing cybersecurity measures.


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our business or our customers' businesses, cause us to lose customers and result in significant financial exposure and legal liability.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of major providers through log reports and intelligent threat protection analysis.


text: The Director of Information Security, reporting to and collaborating with the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.


text: Coherent's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners, employees, shareholders and other stakeholders. One of the critical factors in maintaining this trust is by the Board being involved in oversight of the Company's enterprise risk management ("ERM") program, of which cybersecurity represents a critical component. Coherent's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, and the International Standards Organization Risk Management Guidelines (ISO 31000), as well as other applicable industry standards.

companyName: COHERENT CORP.

ticker: COHR


text: Governance: Coherent's cybersecurity program is overseen by the Board's Environment, Sustainability and Governance ("ESG") committee. The ESG Committee is briefed quarterly by management on, among other things, updates to cybersecurity and related programs, and notable cyber incidents, threats and vulnerabilities, and provides direction on cybersecurity risk management. In addition, Coherent has established a Crisis Management Team (CMT) with responsibility for, among other things, oversight and management of cybersecurity events, including significant and material cybersecurity events. The CMT reports, as appropriate, to the ESG Committee. The CMT is headed by Coherent's Chief Risk Officer (CRO). Additionally, Coherent has a dedicated internal cybersecurity team (Cybersecurity Team), managed by the Global Head of Cybersecurity.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. On a regular meeting cadence, Coherent's President convenes a senior cybersecurity committee for reporting and planning. The committee consists of the Chief Information Officer (CIO), the Global Head of Cybersecurity, the Vice President of IT Operations, the Senior Director of IT Security, the General Counsel for Technology and Risk Management, and the CRO. Members of partner technology-risk advisory firms and Coherent internal experts from other disciplines participate in committee activities as needed from time to time.


text: As to experience of the various members of Coherent's cybersecurity functional team, the CIO is a technology executive with over 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, including leading risk management, data governance, compliance, and SOX audits, aligning technology with business goals and robust data protection. He holds a B.S. in Electrical Engineering and ITIL certification. The Coherent Global Privacy Officer earned a B.A. and a Juris Doctor degree and has over 20 years of experience in legal practice, focusing specifically on privacy law for the past eight years. Additionally, the Coherent Global Privacy Officer is an active member of the International Association of Privacy Professionals (IAPP) and holds both the Certified Information Privacy Professional/Europe (CIPP/E) and Certified Information Privacy Manager (CIPM) certifications from the IAPP. The General Counsel for Technology and Risk Management holds a B.S. in Industrial Engineering, and a Juris Doctor degree and has over 38 years of experience in legal practice, 25 years of which specifically representing businesses and financial institutions in data security and privacy in both private practice and as at in-house attorney at various private and public companies. The Senior Manager, Security, Risk & Compliance, has been in Information Technology for 25 years and in IT security for 16 years, and holds a B.S. in Computer Science, with a minor in Mathematics, and an ISC2 CISSP Certification. He is a member of the ACM and a Senior Member of the IEEE. The Senior Director of Information Security is a CISSP and member of ISSA, practicing security for over 30 years, with a B.S. degree. He also has served as a consultant and has managed international cybersecurity teams with Fortune 100 companies in finance, banking, technology, biotech, security consulting, and large manufacturing in broad areas of cybersecurity. The VP of IT Infrastructure Operations and Interim Head of Information Security and Compliance has 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, and holds a M.S. in Electrical Engineering.


text: Incident Response and Recovery Planning: Coherent has instituted a robust Cybersecurity Incident Response Plan (the CIRP), which provides a framework for responding to cybersecurity incidents at escalating severity levels. The CIRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The CIRP is implemented by the Coherent Cyber Incident Response Team (CIRT), which is headed by the Global Head of Cybersecurity, and includes as members the head of the CMT, the Chief Legal Officer, the Cybersecurity Team, and select members of the ERM team.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.