text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing PPL's cyber-risk management strategy for PPL and the other Registrants and reports directly to PPL's Chief Executive Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. PPL's VP – Cybersecurity is responsible for implementing and executing the cyber-risk management strategy. The VP – Cybersecurity is a seasoned cybersecurity professional with a wealth of experience safeguarding digital assets across multiple industries. He maintains a globally recognized cyber certification and has held multiple certifications in the areas of cyber risk and information control, and actively contributes to industry advancement as a member of national and international industry groups. The teams managed by the CSO and VP – Cybersecurity are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.

companyName: PPL ELECTRIC UTILITIES CORP


text: The Registrants manage cybersecurity risks through monitoring, defense and response tools, including independent third-party assessments, internal audit assessments of the program's effectiveness, intelligence reports, cybersecurity threat trends, implementation of governance models, industry collaboration and employee training and awareness. The Registrants are actively engaged in cybersecurity related industry forums, public-private partnerships with law enforcement, cross-industry peer groups, and other efforts to help improve the protection of the U.S. electric grid.

secItem: Item 1C


text: The Registrants utilize monitoring tools, including but not limited to, cybersecurity incident and event management, penetration testing, intrusion detection and prevention, vulnerability assessments and anti-virus systems to detect anomalous or suspicious system or network activity. The Registrants may also become aware of a potential cybersecurity event or incident through employee reports, notification by a third-party service provider or business partner with potential impact to the Registrants or their systems, customers or notification by a government agency. The Registrants' subject matter specialists from across the enterprise provide input and expertise into risk governance processes, including cybersecurity, information technology, legal, compliance, operations, and enterprise risk management.


text: In developing their cybersecurity programs, the Registrants are guided by various frameworks including the NIST Cybersecurity Framework, a voluntary framework that consists of standards, guidelines and best practices for managing cybersecurity risk, that is widely used by critical infrastructure industries to help determine and address the highest priority cybersecurity risks. The Registrants conduct regular internal cybersecurity audits and vulnerability assessments and regularly engage with third-party cybersecurity experts for external assessments of their cybersecurity controls, including technical, physical and social aspects, to better comprehend the scope and magnitude of active threats to the industry and nation and their potential impact on our systems.


text: PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. The VP – Cybersecurity chairs the Cybersecurity Governance Council, which governs actions to ensure that the Registrants are effectively managing cybersecurity risks, as well as the Cybersecurity Steering Committee, that drives accountability, establishes work priorities, and directs a portfolio of key cybersecurity projects and initiatives.


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 13 to the Financial Statements for additional information on these directives.


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future, successful attacks, threats or incidents, which may be material.


text: See "Risks Related to All Segments – Our business operations are continually subject to cyber-based security and data integrity risks from vulnerabilities related to our IT systems, operational technology infrastructure and supply chain relationships" in "Item 1A. Risk Factors" for a discussion of cybersecurity risks affecting the Registrants.


text: Oversight of Cybersecurity Risks by the Board of Directors and Management PPL's Board of Directors oversees the Registrants' management of cybersecurity risk through various processes identified below.


text: The Board has direct oversight of the Registrants' cybersecurity programs through periodic reports from the CSO, at least twice a year, regarding cybersecurity matters and risks as well as the adequacy and effectiveness of our cybersecurity risk management program. Through these reports, the Board monitors the Registrants' programs, processes and procedures related to cybersecurity. The Board has directed the CEO and CSO to promptly inform the Board in the event of a material or potentially material cybersecurity event. Each member of the Board has access to management, including the CEO and CSO, to ask questions and engage on the company's approach to prevent, detect, assess, and mitigate cybersecurity risk. PPL's Board has several Board members with experience in cybersecurity, including one with a certificate in Cyber-Risk Oversight from the National Association of Corporate Directors.


text: A primary function of the Audit Committee is to assist the Board in the oversight of the identification, assessment and management of risk. Cybersecurity risks are included in PPL's enterprise risk management process and are reported to the Audit Committee of the Board on a quarterly basis or more frequently, as needed.


text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing, implementing and executing PPL's cyber-risk management strategy for PPL and the other Registrants and reports to PPL's Executive Vice President and Chief Technology and Innovation Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. The teams managed by the CSO are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Technology and Innovation Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, Chief Security Officer and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 12 to the Financial Statements for additional information on these directives.


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future attacks, threats or incidents, the consequences of which may be material.


text: Cybersecurity Risk Management Our Privacy and Information Security Committee, comprised of officers and senior leaders, is responsible for overseeing the development and maintenance of information privacy and security policies and effective operation of our corporate information security and cybersecurity program in compliance with applicable state insurance regulations and other legal and regulatory requirements. This committee is sponsored by and reports directly to our Executive Council, which includes our Chief Executive Officer and executive vice presidents.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: As part of our overall Enterprise Risk Management ("ERM") program, we employ a cybersecurity program of technical, administrative, and physical controls intended to reduce the risk of cyber threats and protect our information, as well as documented processes to determine and make appropriate disclosures regarding potential material threats and incidents. Our cybersecurity philosophy and approach align to the National Institute of Standards and Technology Cybersecurity Framework and its core elements to identify, protect, detect, respond, and recover from the various forms of cyber threats. Our practices include, but are not limited to, cybersecurity protocols and controls, system monitoring and detection, communication of incidents to appropriate management, third-party risk management, including assessments of emerging threats and vulnerabilities, and ongoing privacy and cybersecurity training for employees and contractors concerning cyber risk. A foundational element of our cybersecurity risk management processes is the annual Cybersecurity and Information Security Risk Assessment (CSRA), which includes an analysis of cybersecurity risks facing us and associated recommendations and action items to mitigate identified risks. We periodically utilize third parties to assess the effectiveness of our cybersecurity efforts through independent validations, verifications, and security assessments.


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.


text: We have a core incident response team (Core Team) consisting of dedicated, skilled leadership representatives from our Information Security, Privacy and Law teams, responsible for analyzing and assessing cyber incidents and leading response efforts. Our Chief Information Security Officer (CISO), responsible for overseeing and managing information security incidents, has over 25 years of experience in information technology (IT), including over 20 years dedicated to practicing or leading cybersecurity functions. Our CISO is also a Certified Information Systems Security Professional (CISSP). Our Privacy leader, responsible for managing privacy incidents, has over 20 years of experience in IT risk management, including over 10 years in IT risk and control functions and the remaining time focused on privacy and cybersecurity related functions and holds several information privacy and risk certifications. Our Legal leader, responsible for providing guidance on legal and other regulatory obligations in the areas of privacy, cybersecurity, technology, data use and third-party risk management, holds a Juris Doctor degree, is licensed to practice law, and has over 20 years of legal experience, including 10 years focused on privacy and cybersecurity and holds several information security and privacy certifications, including the CISSP. The Core Team leaders are members of various organizations that support cybersecurity or privacy intelligence, education, information sharing and networking, including among others the Financial Services Information Sharing and Analysis Center (FS-ISAC), Domestic Security Alliance Council (DSAC), InfraGard, and International Association of Privacy Professionals (IAPP).


text: The Core Team members are augmented as needed by representatives from other internal groups, including subject matter experts from Information Security, Privacy, Finance and Law, as well as certain third parties that may need to participate in the incident response process. Depending on the severity and impact of the incident, third parties engaged may include outside counsel, forensics investigators, public relation firms, data breach resolution providers, and cyber insurance brokers and carriers. In conjunction with legal counsel, the Core Team evaluates notification requirements and as necessary will notify stakeholders depending on the nature and severity of the incident, including law enforcement, state attorneys general, regulators, external auditors, third party providers, and impacted individuals.


text: The Core Team is informed of cyber incidents from diverse sources, including for example, internal monitoring systems, information sharing organizations, employees, and other external information sources. Depending upon the levels of access to our information and/or information systems, third party service providers are contractually obligated to report cybersecurity incidents within their environments. The Core Team performs incident analysis and triage to determine scope, severity, prioritization and required response plans to address an incident in a manner that is intended to minimize the impact to us, our assets, and our operations. In accordance with applicable legal and regulatory requirements, this analysis and triage step includes an assessment of the potential for material impact to us from a cybersecurity incident or a series of individually immaterial related incidents that are material when aggregated.


text: To date, we are not aware of any cybersecurity breach or other incident with respect to our systems or data that would have a material impact to our business strategy, results of operations or financial condition. Additionally, we are not aware of any cybersecurity breach or other incident experienced by anyone with whom we have a third-party relationship that has had a material impact on our systems or data. However, there can be no guarantee that we will not experience any such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management We maintain a cybersecurity program in alignment with our overall Enterprise Risk Management ("ERM") program. See Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" contained within this report for additional information on the ERM function. Our Privacy and Information Security Committee, comprised of officers and senior leaders, is responsible for overseeing the development and maintenance of information privacy and security policies and effective operation of our corporate information security and cybersecurity program in compliance with applicable state insurance regulations and other legal and regulatory requirements. This committee is sponsored by and reports directly to our Executive Council, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer, executive vice presidents and certain senior vice presidents reporting directly to the CEO as applicable.


text: Our cybersecurity program of technical, administrative, and physical controls is intended to reduce the risk of cyber threats and protect our information, as well as document processes to determine and make appropriate disclosures regarding potential material threats and incidents. Our cybersecurity philosophy and approach align to the National Institute of Standards and Technology Cybersecurity Framework and its core elements to govern, identify, protect, detect, respond, and recover from the various forms of cyber threats. Our practices include, but are not limited to, cybersecurity protocols and controls, system monitoring and detection, communication of incidents to appropriate management, third-party risk management, including assessments of emerging threats and vulnerabilities, and ongoing privacy and cybersecurity training for employees and contractors concerning cyber risk. A foundational element of our cybersecurity risk management processes is the annual Cybersecurity and Information Security Risk Assessment (CSRA), which includes an analysis of cybersecurity risks facing us and associated recommendations and action items to mitigate identified risks. We periodically utilize third parties to assess the effectiveness of our cybersecurity efforts through independent validations, verifications, and security assessments.


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on the emerging cybersecurity threat landscape and our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.


text: Risk Management and Strategy Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our Technology Strategy to 2025.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Our overall cybersecurity risk management objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards, threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization.


text: We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with material impact or reasonably likely to materially impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.


text: Our cybersecurity risk governance model consists of three lines of defense. Our Chief Technology Officer, supported by the experts in our Technology Leadership Centre and IT and cybersecurity teams at our subsidiaries represent the first line. Our Chief Risk Officer, supported by corporate and subsidiary risk teams, and Risk Committee of the board of directors represent the second line. The third line consists of our Controlling Department, subsidiary internal audit functions and Audit Committee of the board of directors.


text: Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, cybersecurity and data protection professionals from our Technology Leadership Centre with extensive IT, cybersecurity and data protection education and experience, including from regulatory agencies. At the subsidiary level our IT and cybersecurity management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing cyber risks.


text: Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our Technology Strategy to 2025, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity and privacy incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers periodically report to the Risk Committee of the board of directors. Our Chief Technology Officer also regularly reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer also periodically reports directly to the board of directors including on cybersecurity incidents and risks.


text: Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Our audit procedures include testing of IT and cybersecurity. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of IT and cybersecurity controls and governance. The department is directly subordinate to the Audit Committee of our board of directors.


text: Notwithstanding our defensive measures and processes, the threats posed by IT failures and cyber-attacks are always present. While our subsidiaries have experienced cybersecurity incidents in the past, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition, cash flows or results of operations as of the date of this report.


text: We do not maintain insurance policies to mitigate cybersecurity risks because such insurance may not be available or may be more expensive than the perceived benefit. Further, any insurance that we may purchase to mitigate certain risks may not cover all losses.


text: For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Information Technology and Cybersecurity" in Item 1A. Risk Factors.


text: Risk Management and Strategy Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our technology strategy.


text: Our overall cybersecurity risk management covers IT, information security and data protection risk and its objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards (such as ISO, NIST, CIS, FAIR and others), threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Some of our subsidiaries are certified under ISO 27001, an international information security management systems standard, or undergo regular Payment Card Industry Data Security Standard (PCI) audits. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists utilizing methods such as penetration testing, vulnerability scanning, code, configuration reviews. risk and security assessments. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain, utilizing methods such as security assessments, SLAs, information security and data protection contractual clauses. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization.


text: We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with a material or reasonably likely material impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.


text: Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, information security and data protection professionals from our Technology Leadership Centre with extensive experience, including from regulatory agencies. At the subsidiary level our management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing associated risks.


text: Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our technology strategy, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries at least annually provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks.


text: Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Audit or assurance procedures of Controlling Department, internal audit departments and other functions include testing of IT, information security and data protection controls. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of our governance. The department is directly subordinate to the Audit Committee of our board of directors.


text: Notwithstanding our defensive measures and processes, the threats posed by IT failures and cyber-attacks are always present. The potential impact of risks from IT incidents, including whether such IT incidents may be associated with cybersecurity threats to the Company, is assessed on an ongoing basis.


text: For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Information Technology and Cybersecurity" in "Risk Factors" in Part I Item 1A of this annual report.


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems, and those that are offered to residents and tenants are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, for facilitation of operations, including monitoring and optimization of various building management systems, for initiation, generation, and completion of resident leasing, for internal communications, and for various other aspects of the business.

companyName: Veris Residential, L.P.


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company has implemented or is in the process of continuously evaluating, testing and updating various information security processes and policies designed to identify, assess and manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Company's residents' and employees' personal data.


text: The Company's cybersecurity risk management relies on a multidisciplinary team, including its information technology and cybersecurity team, legal department, executive management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. In 2023, the Company expanded its team by adding a full-time Chief Information Security Officer (CISO), reporting directly to the Chief Operating Officer, responsible for managing the internal and external cybersecurity resources. The CISO has over 30 years of experience in corporate enterprise infrastructure and data security management held at a senior management level, acting in both a corporate as well as consulting role within many highly regulated industries. The CISO is responsible for having successfully developed and implemented several cyber security programs within prominent companies within the retail, financial and life science sectors.


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. This multi-faceted approach to cybersecurity includes physical, administrative, and technical safeguards. During the year ended December 31, 2023, the Company began utilizing the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), to assess and report to the Company's executive management and Board of Directors on the current maturity of operational and procedural controls for securing and safeguarding the Company's information technology assets. The Company will continue to utilize the NIST CSF to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture.


text: To operate its business, the Company engages certain third-party vendors to perform a variety of functions. The Company seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Company's vendor management procedures including reviewing the cybersecurity procedures, imposing contractual requirements, and conducting periodic reassessments as needed. The Company seeks to further enhance this review to expand the scope and depth of this analysis.


text: As a result of these factors, the Company has adopted a strategic multi-year cybersecurity plan. This plan is not meant to be all encompassing as the cybersecurity landscape shifts and evolves, and the Company is continually assessing its risks and the evolving cybersecurity threat landscape. This plan includes implementing additional and/or fortifying existing defenses and capabilities necessary to protect and preserve the integrity of the Company's information assets and mitigate the risks to the Company's business operations. As part of this plan, the Company requires regular cybersecurity training for all employees and periodically conducts tests to assess employee comprehension and evaluate training effectiveness.


text: The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.


text: The Company's Audit Committee holds oversight responsibility over the cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. The Company prepares a quarterly report from the Chief Operating Officer and the CISO which includes updates on the Company's current cybersecurity maturity, progress on the Company's previously mentioned multi-year cybersecurity plan, strategy updates to combat changes in the threat landscape, education of employees and executive management on cybersecurity awareness, enhanced cybersecurity defenses, incident response programs and regulatory reporting obligations. The Audit Committee delivers a summary of these reports to the full Board of Directors on a quarterly basis. Furthermore, the Board of Directors receives a direct report from the CISO on no less than an annual basis with interim reports provided when appropriate or necessary.


text: As part of the Company's incident response plan, a committee known as the Cyber ERM (Enterprise Risk Management) Committee has been established comprising cross-functional representation across the Company. The Cyber ERM is responsible for implementing a rapid response and incident program in the event of an identified cybersecurity threat and is responsible for reporting all incidents to the Audit Committee and Board of Directors in the case of any cybersecurity incident to enable the Audit Committee and Board of Directors to assess the materiality of any such incident and determine any Exchange Act reporting obligations of the Company in connection therewith.


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company has implemented or is in the process of continuously evaluating, testing and updating various information security processes, policies and protective technologies designed to identify, assess and manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Company's residents' and employees' personal data.


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. This multi-faceted approach to cybersecurity includes physical, administrative, and technical safeguards. During the year ended December 31, 2024, the Company utilized the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), to assess and report to the Company's executive management and Board of Directors on the current maturity of operational and procedural controls for securing and safeguarding the Company's information technology assets. The Company will continue to utilize the NIST CSF to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture.


text: The Company's Audit Committee holds oversight responsibility over the cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. The Company prepares a quarterly report from the Chief Operating Officer and the CISO which includes updates on the Company's current cybersecurity maturity, progress on the Company's previously mentioned multi-year cybersecurity plan, strategy updates to combat changes in the threat landscape, education of employees and executive management on cybersecurity awareness, enhanced cybersecurity defenses, incident response programs and regulatory reporting obligations. The Audit Committee delivers a summary of these reports to the full Board of Directors on a quarterly basis. Furthermore, the Board of Directors receives a direct report from the CISO on no less than an annual basis, with interim reports provided when appropriate or necessary.


text: In general, the Company addresses cybersecurity risks through a comprehensive approach that is focused on preserving the security of its information and by identifying, preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur. The Company believes that this comprehensive approach helps to ensure that the highest levels of oversight is provided to its cybersecurity risk management activities and fosters collaborative consultation between management and the Board.

companyName: OMNICELL, INC.

ticker: OMCL


text: As part of its risk oversight function, the Audit Committee of the Company's Board of Directors is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. These reports include semi-annual cybersecurity updates from the Company's Chief Information Officer and quarterly reports from the Company's risk management personnel on the progress of the Company's broader Enterprise Risk Management ("ERM") risk mitigation activities. As part of the ERM process, the Audit Committee provides input on key risks for the Company to consider. In addition, the Board also provides quarterly input on its views regarding potential emerging risk areas for the Company. The Audit Committee then reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.


text: Enterprise Risk Management Omnicell utilizes a structured, biannual ERM process to identify, assess, and address material risks facing the Company, including cybersecurity risks, during which business leaders across the Company are surveyed about current and emerging risk areas. After the ERM survey is completed and risk areas are identified, the results are discussed with the relevant management personnel across the organization in the key risk areas, root causes are analyzed and risk mitigation plans are developed. The Chief Information Officer works closely with Omnicell's management team in all facets of its ERM risk mitigation activities related to cybersecurity and information security risks.


text: Ongoing Mitigation Efforts The Company has implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, the Company has continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. The Company has focused on its incident response procedures and retained a leading incident response provider. The Company has also recently strengthened its disaster recovery procedures. The Company's solutions incorporate cybersecurity features that are routinely analyzed. In addition, the Company maintains insurance that includes coverage for cyber-attacks, which coverage is discussed and reviewed with the Audit Committee annually.


text: The Company has what it believes are appropriate physical, technical, and administrative controls in place that are designed to protect customers' data. However, as previously disclosed, on May 4, 2022, the Company determined that certain of its information technology systems were affected by ransomware impacting certain internal systems. Upon detecting the security event, the Company took immediate steps designed to contain the incident and implement its business continuity plans to restore and support continued operations. Subsequently, the Company contained the incident and restored substantially all of its critical information technology systems.


text: Following this cybersecurity event, the Company immediately implemented several key learnings from the incident, including using a three-pronged approach focused on further reducing exposure, raising greater security awareness, and further strengthening the Company's cybersecurity defenses. This approach resulted in the Company further hardening its identity computing environments as part of its progress to a zero trust environment, heightened cybersecurity awareness efforts through increased comprehensive information security awareness training for employees on a quarterly basis, and the strengthening of the Company's cybersecurity defenses through implementation of multifactor authentication for Privileged Access Management and Endpoint Detection and Response solutions across the Company's computing environment.


text: Incident Response In the event of a cybersecurity incident, dependent upon the nature of the incident, the Company has a Security Incident Response Team ("SIRT") that is comprised of employees who have responsibility and authority to act during a cyber incident without delay, including, dependent upon the nature of the incident, the Company's Chief Legal Officer, Chief Information Security Officer and Chief Information Officer. The SIRT includes individuals responsible for assessing, containing, and responding to incidents, as well as those responsible for assessing the business and legal impacts, reporting incidents as appropriate, communicating to internal and external stakeholders, and engaging with industry and government response partners to coordinate information and resource sharing when needed. During a cybersecurity incident, as warranted, the SIRT keeps the Company's senior leadership and Board apprised of the response to the incident, any operational or business impacts, and any internal or external communications regarding the incident. The SIRT will also seek the input of the Company's senior leadership and Board, as needed, when addressing a cybersecurity incident. Upon resolution of a cybersecurity incident, generally, the Audit Committee will review the incident, the impact and the mitigation efforts and remediation actions the Company will implement. The Audit Committee then monitors the completion of the remediation actions and mitigation efforts.


text: Cybersecurity Leaders in Management The Company's IT strategy and implementation is overseen by a dedicated Chief Information Officer with over 20 years of experience in the field, including previously serving a 17-year tenure, most recently as Vice President of Global IT, with a global technology leader of fiber optic subsystems and components. He holds a Bachelor of Science in Computer Science and Engineering from Andhra University in India and an MBA from the Indian School of Business. In addition, the Company has recently engaged a Chief Information Security Officer ("CISO"). The Company's CISO has built and managed world-class information security programs and technology teams for industry leading global companies. She has deep experience securing healthcare-focused companies in both the provider and supplier space. She holds a Bachelor of Science from the University of Redlands and an MBA from Notre Dame De Namur University along with holding certified information systems security professional ("CISSP") and certified information security manager ("CISM") certifications.


text: The Company utilizes third-party service providers, such as cloud services, in connection with its operations, and its information security department implements a third-party risk assessment and review process in connection with those services to evaluate security posture and risk. The Company also engages third parties to assist in its cybersecurity management efforts, such as the leading incident response provider mentioned above and another provider to perform continuous monitoring and regular penetration testing of its information security systems and environment. The Company and its personnel also actively engage with a number of other key vendors, industry participants and intelligence and law enforcement communities as part of its information security and cybersecurity efforts.


text: Impact of Recent Cyber Incident While the previously disclosed ransomware incident led to (i) temporarily delayed invoicing that impacted the timing of cash collections and free cash flow in 2022 and (ii) customer implementation delays in 2022, as the Company recovered from the impacts of the ransomware incident, substantially all delayed implementations due to the ransomware incident were completed as of the end 2022. Furthermore, any delayed or impacted processes have returned to normal operations. To date, the Company does not believe the ransomware incident, or other identified cyber risks, have had, or will have, a material adverse effect on its business, operating results, cash flow, or financial condition.


text: As part of its risk oversight function, the Audit Committee of the Company's Board of Directors is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. These reports include semi-annual cybersecurity updates from the Company's Chief Information Officer and quarterly reports from the Company's risk management personnel on the progress of the Company's broader Enterprise Risk Management ("ERM") risk mitigation activities. As part of the ERM process, the Audit Committee provides input on key risks for the Company to consider. The Board also provides quarterly input on its views regarding potential emerging risk areas for the Company. The Audit Committee then reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board periodically participates in cybersecurity-related table-top exercises and receives incident reports from the SIRT (as defined herein) as significant matters may arise.


text: Enterprise Risk Management The Company utilizes a structured, biannual ERM process to identify, assess, and address material risks facing the Company, including cybersecurity risks, during which business leaders across the Company are surveyed about current and emerging risk areas. After the ERM survey is completed and risk areas are identified, the results are discussed with the relevant management personnel across the organization in the key risk areas, root causes are analyzed, risk mitigation plans are developed, and key risk indicators are utilized to monitor mitigation efforts. The Chief Information Officer works closely with the Company's management team in all facets of its ERM risk mitigation activities related to cybersecurity and information security risks.


text: Ongoing Mitigation Efforts The Company has implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, the Company has continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. The Company has focused on its incident response procedures and retained a leading incident response provider. The Company has also recently strengthened its disaster recovery procedures. The Company's solutions incorporate cybersecurity features that are routinely analyzed. In addition, the Company maintains insurance that responds to cyber-attacks, which coverage limit and cost is discussed and reviewed with the Audit Committee annually.


text: The Company has what it believes are appropriate physical, technical, and administrative controls in place that are designed to protect customers' data. The Company uses a three-pronged approach focused on further reducing exposure, raising greater security awareness, and further strengthening the Company's cybersecurity defenses. This approach resulted in the Company further hardening its identity computing environments as part of its progress to a zero trust environment, heightened cybersecurity awareness efforts through increased comprehensive information security awareness training for employees on a quarterly basis, and the strengthening of the Company's cybersecurity defenses through implementation of multifactor authentication for Privileged Access Management and Endpoint Detection and Response solutions across the Company's computing environment.


text: Incident Response In the event of a cybersecurity incident, dependent upon the nature of the incident, the Company has a Security Incident Response Team ("SIRT") that is comprised of employees who have responsibility and authority to act during a cyber incident without delay, including, dependent upon the nature of the incident, the Company's Chief Legal Officer, Chief Information Security Officer and Chief Information Officer. The SIRT includes individuals responsible for assessing, containing, and responding to incidents, as well as those responsible for assessing the business and legal impacts, reporting incidents as appropriate, communicating to internal and external stakeholders, and engaging with industry and government response partners to coordinate information and resource sharing when needed. During a cybersecurity incident, as warranted, the SIRT keeps the Company's senior leadership and Board apprised of the response to the incident, any material operational or business impacts, and any material internal or external communications regarding the incident. The SIRT will also seek the input of the Company's senior leadership and Board, as needed, when addressing a cybersecurity incident. Upon resolution of a cybersecurity incident, generally, the Audit Committee will review the incident, the impact and the mitigation efforts and remediation actions the Company will implement. The Audit Committee then monitors the completion of the remediation actions and mitigation efforts.


text: Cybersecurity Leaders in Management The Company's IT strategy and implementation is overseen by a dedicated Chief Information Officer with over 20 years of experience in the field, including previously serving a 17-year tenure, most recently as Vice President of Global IT, with a global technology leader of fiber optic subsystems and components. He holds a Bachelor of Science in Computer Science and Engineering from Andhra University in India and an MBA from the Indian School of Business. In addition, the Company has engaged a Chief Information Security Officer ("CISO") that has built and managed world-class information security programs and technology teams for industry leading global companies. She has deep experience securing healthcare-focused companies in both the provider and supplier space. She holds a Bachelor of Science from the University of Redlands and an MBA from Notre Dame De Namur University along with holding certified information systems security professional ("CISSP") and certified information security manager ("CISM") certifications.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Our cybersecurity function, which comprises, in part, our IT department, legal team, human resources team and our audit committee, helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, data encryption, network security controls, employee training, access controls, physical security, systems monitoring, and asset management, tracking, and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel) and cybersecurity consultants. We also use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, application providers, and supply chain resources. We manage cybersecurity risks associated with our use of these providers by, for example, requesting and analyzing responses on a security questionnaire and conducting audits and risk assessments on certain vendors. In particular, our legal department performs an assessment on each vendor and based on certain criteria will have our IT team perform a security assessment.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "The operation of Aspira Labs and our Aspira Synergy business depends on the effectiveness and availability of our information systems, including the information systems we use to provide services to our customers and to store employee data, and failures of these systems, including in connection with cyber-attacks, may materially limit our operations or have an adverse effect on our reputation."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Manager of IT Infrastructure, who has over 20 years of experience in various IT administration roles, five of which have been in cybersecurity.


text: Our HR department is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO, working with our Manager of IT Infrastructure, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our legal department is also responsible for performing a cyber risk assessment on each new vendor.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including our Manager of IT Infrastructure. Our Manager of IT Infrastructure works with our incident response team to help us to mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our cybersecurity function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Assessment Advanced Energy understands the importance of managing risks from cybersecurity threats and maintains a comprehensive cybersecurity program developed with reference to the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cybersecurity program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of our data. We devote significant resources to network, operations, and product security, data encryption, business continuity/disaster recovery, vulnerability management, event monitoring and incident response, and other measures to protect our systems and data from unauthorized external access or internal misuse, including, but not limited to, the following:

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Operational Security. Access to our systems is restricted to those who require access in accordance with the principle of least privilege. We also conduct background checks for our employees where permitted by local law, require signed confidentiality agreements and acceptable use agreements, and follow termination/access removal processes.


text: Employee Training. We provide all employees with annual training on information security, data protection, and relevant company policies so that they are empowered to identify cybersecurity risks and take action. To further enhance awareness and responsiveness to potential threats, we also conduct regular phishing simulations and email communications on cybersecurity trends awareness throughout the year. Third Party Assessment. We engage independent third party consultants to review the effectiveness and maturity of our cybersecurity program.


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, and operational personnel.


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.


text: Risk Monitoring. Management and our Board monitor cybersecurity and data protection developments, including new or forthcoming changes to the legislative and regulatory landscape as well as Advanced Energy's cybersecurity processes, investments, and actions as described below.


text: Cybersecurity risk is a component of Advanced Energy's broader risk management program and managed at the highest levels of the company, starting with Advanced Energy's CIO, who meets with the Chief Executive Officer and other members of executive management regularly to discuss issues, assess risks, and coordinate company-wide cybersecurity initiatives. Our CIO leads a dedicated cybersecurity technical team that manages, monitors, and enforces compliance with the cybersecurity program.


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached or fail and a customer's or our data is improperly obtained or unauthorized access to our information technology systems occurs, we may incur significant legal and financial exposure and liabilities." under the heading Part I, Item 1A "Risk Factors".


text: Cybersecurity Governance Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, the full Board receives a cybersecurity briefing from the CIO annually.


text: As discussed above, our cybersecurity risk management and strategy are led by our CIO, who has extensive leadership experience with enterprise information technology in the manufacturing and telecom industries, where he has held various executive roles in which he developed and executed IT strategy, including cybersecurity programs, helped achieve and maintain Sarbanes-Oxley compliance, and brought companies into compliance with ISO 27001, among other things.


text: Risk Management and Strategy Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).

companyName: DAVITA INC.

ticker: DVA


text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; and • Monitoring these potential risks on a regular basis.


text: Our Enterprise Risk Management (ERM) team leads this risk management process, and evaluates risks to the enterprise on short, intermediate and long-term bases. Our ERM team reports to our ERM Committee, a group comprised of members of senior management who meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT Security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Legal, Internal Audit and Compliance Audit teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT Security and Privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team have actively participated in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.


text: We maintain policies and have established processes involving our cybersecurity, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.


text: Cybersecurity Risks and the Impact on our Company Due to the continuously evolving series of laws and regulations related to cybersecurity, data protection and privacy that are applicable to our business, as well as the associated risks from cybersecurity threats, we have expended significant resources in order to protect our information systems and data. We regularly review, monitor and implement multiple layers of security measures through technology, processes and our people. We utilize security technologies designed to protect and maintain the integrity of our information systems and data, and our defenses are monitored and routinely tested internally and by external parties. Despite these efforts, our facilities and systems and those of our third-party service providers may be vulnerable to privacy and security incidents; security attacks and breaches; acts of vandalism or theft; computer viruses and other malicious code; coordinated attacks by a variety of actors, including, among others, activist entities or state sponsored cyberattacks; emerging cybersecurity risks; cyber risk related to connected devices; misplaced or lost data; programming and/or human errors; or other similar events that could impact the security, reliability and availability of our systems. Internal or external parties have attempted to, and will continue to attempt to, circumvent our security systems, and we have in the past, and expect that we will in the future, defend against, experience, and respond to attacks on our network including, without limitation, reconnaissance probes, denial of service attempts, malicious software attacks including ransomware or other attacks intended to render our internal operating systems or data unavailable, and phishing attacks or business email compromise. While we have experienced cybersecurity incidents in the past, to date none have had a material impact on our business, results of operations, financial condition and cash flows.


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Item I.A. Risk Factors under the heading, "Privacy and information security laws are complex ".


text: As part of their oversight responsibilities, the Audit Committee and the Compliance and Quality Committee monitor privacy, data and cyber security as specific risk areas. Both Mr. Schechter, a member of the Audit Committee and the Compliance and Quality Committee, and Ms. Schoppert, a member of the Audit Committee and the Compliance and Quality Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The CPO or CLO provides periodic updates to the Audit Committee on the status of the privacy program. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.


text: As referenced above, our IT Security team, in consultation with our Privacy Office, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO holds a Certified Chief Information Security Officer certification from EC-Council and a Certified Information Security Manager certification from ISACA. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.


text: Our IT Security team also operates a 24x7 security operations center through a managed service provider. This dedicated center, alongside active monitoring of the dark web for DaVita-related data, and our use of both internal and external tools, is designed to ensure proactive detection, prevention and remediation of cybersecurity incidents. We inform and develop this integrated approach through our ongoing internal and external evaluations and risk assessments of our IT security program as described above.


text: Risk Management and Strategy Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including, but not limited to, sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).


text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; • Monitoring these potential risks on a regular basis; and • Evaluating whether there are new potential risks to assess.


text: Under our Enterprise Risk Management (ERM) process, the Company evaluates risks to the enterprise on short, intermediate and long-term bases. The ERM Committee, a group comprised of members of senior management, meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Internal Audit, legal and compliance teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT security and privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team actively participate in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.


text: We maintain policies and have established processes involving our IT security, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Part I Item IA. "Risk Factors" under the heading, "Privacy and information security laws are complex ".


text: As part of its oversight responsibilities, the Audit Committee monitors privacy, data and cybersecurity as specific risk areas. The Audit Committee also works with the Compliance and Quality Committee to oversee enterprise risks with healthcare and anti-corruption requirements, and those requirements include certain privacy, data and cybersecurity aspects. Both Mr. Schechter, a member of the Audit Committee, and Ms. Schoppert, a member of the Audit Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. On a periodic basis, the full Board of Directors also receives these reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.


text: As referenced above, our IT security team, in consultation with our privacy team, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO has more than two decades of experience in information technology risk and compliance and holds a Certified Chief Information Security Officer certification from EC-Council, a Certified Information Security Manager certification from ISACA and a certification from the Massachusetts Institute of Technology on AI management in healthcare. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.


text: Overview. Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quant Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative, and physical controls.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Governance. Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: Management and Strategy. Senior management takes the guidance provided by the Board of Directors and transforms this guidance into operational priorities which are implemented and maintained by the staff members and third-party service providers. In addition, the senior management team ensures that budgeted resources are allocated in a timely manner to support the various security initiatives.


text: Operational Information Technology and Information Security staff members, and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to Operating Risk and Executive Committees and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.


text: We also utilize the services of third-party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.


text: Finally, Quaint Oak Bank complies with its regulatory requirements by having Federal and State safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations Quaint Oak Bancorp and Quaint Oak Bank have to their respective customers, shareholders, staff members, and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Quaint Oak Bancorp, its business strategy, financial condition, or results of operation.