text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:

secItem: Item 1C


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our IT Director, who reports to our Chief Financial Officer and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our IT Director leads our information technology team and regularly reports to our Audit Committee.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our IT Director based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Financial Officer, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our IT Director has served in various roles in technology leadership for more than 20 years, including cybersecurity. With an undergraduate degree in Information Systems, an MBA, and certification as a Certified Information Systems Security Professional (CISSP) from ISC2, the IT Director plays a key role in managing risks at our company. This includes risks arising from cybersecurity threats, drawing on extensive experience gained from similar companies and leadership positions across the technology sector. Although the Company does not have both a Chief Technology Officer or a Vice President of Security, the IT Director's expertise ensures robust risk management practices are in place. Our Chief Executive Officer, Chief Financial Officer and IT Director each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: ESSA Bank and Trust has adopted an Incident Response Plan (the "IR PPlan") for responding to cybersecurity incidents. This IR Plan applies to both potential and actual incidents. The IR Plan should be invoked in any context where the Bank believes that an incident may have occurred. The IR Plan applies to all employees, contractors, and third parties. The objectives of the IR Plan are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.

companyName: ESSA Bancorp, Inc.


text: Implementation of the IR Plan requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Plan are spread across the entire organization of the Bank's senior.


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.


text: During the fiscal year ended September 30, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy At Genasys, cybersecurity risk management is integrated into our overall risk management program through regular internal risk assessments and continuous monitoring. Under the leadership of the Information Technology ("IT") Director, IT developed, implemented, and maintain a broad range of processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Our protocols include a third-party provided 24/7 Security Operations Center (SOC), which is designed to oversee our Endpoint Detection and Response (EDR) system and a robust Security Information and Event Management (SIEM) system that aggregates logs for real-time threat detection.

companyName: Genasys Inc.

ticker: GNSS


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Third-party risk is managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.


text: Notwithstanding the foregoing, we have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. See "Risk Factors – Actual or perceived failures or breaches of our information and security systems, or those of our customers, suppliers or business partners, could expose us to losses."


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and includes it as part of the full Board's oversight function. The full Board is updated on cybersecurity risks and compliance with relevant standards and regulations as part of its overall governance responsibilities, including quarterly Board meeting reports. Our Director of IT, who is responsible for the oversight and implementation of the cybersecurity program, also periodically makes presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company. Additionally, we have an escalation process to inform the Board of high-severity cybersecurity incidents that may occur. Our Board also periodically engages independent third-party technology experts to test our information technology systems, including cybersecurity.


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of three IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations via KnowBe4, as part of a comprehensive awareness program.


text: Cybersecurity Risk Management and Strategy We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our IT systems. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we plan to implement a process to review risks to our Company in connection with certain third-party providers and vendors, which we expect will involve assessments through vendor questionnaires, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party IT service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report.


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Vice President, Information Technology, or IT, who has approximately 20 years of experience in information technology and information systems management. Our Vice President, IT reports to our Chief Financial Officer.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process. Our Board of Directors does not have a standing risk management committee, and administers this oversight function both directly as a whole, and through various standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee is responsible for overseeing the Company's enterprise risk management processes as well as our policies with respect to risk assessment and risk management, which includes cybersecurity risk. A cybersecurity update is provided at least annually, or more frequently as needed, to the Audit Committee by members of management responsible for managing cybersecurity risks.


text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services.

companyName: SLB LIMITED/NV

ticker: SLB


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. SLB has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST CSF.


text: SLB has a Cybersecurity Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.


text: Cyber partners are a key part of SLB's cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB's environment as well as, if necessary, assist in responding to cyber attacks.


text: SLB's Cybersecurity Director reports to SLB's Chief Information Officer and is the head of the Company's cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants engaged by SLB.


text: The Audit Committee of the Board of Directors oversees SLB's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company's enterprise risk management process.


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB's business, financial condition, results of operations, or cash flows. See "Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our reputation, business, financial condition, results of operations, and cash flows."


text: The Company's senior management is actively involved in oversight of the Company's risks and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including two factors: authentication, firewalls, anti-malware functionality, email threat protection and access controls, which are evaluated and improved through vulnerability assessments.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact on our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides training, support and alerts for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Senior management, in coordination with the Company's third-party service providers specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through ongoing communications with third party service providers, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: Cybersecurity incidents have not materially affected the Company's results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: As part of our cybersecurity risk management, we have established controls and procedures to guide the Company through an active threat or incident to the recovery of normal business, following industry-standard data protection standards. The controls and procedures provide for the identification, notification, escalation, communication, and remediation of cybersecurity incidents to management, including where appropriate the board of directors, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. We maintain an Executive Cyber Response Team composed of senior leaders across various functions, including our CIO, General Counsel, Chief Accounting Officer and VP Communications. The Executive Cyber Response Team is trained and experienced in managing cybersecurity incidents and meets regularly to practice and refine our processes for incident response, management and escalation through tabletop exercises simulating cyberattacks administered by a legal advisor with extensive experience in cyber investigations, cyber threats and cyber-enabled frauds. The results of such exercises are then reported to management and our board of directors. The third-party legal advisor also assesses and advises on our overall cybersecurity program, reports to our board of directors on a periodic basis and is engaged to provide support in the event an attack or other intrusion were to be successful.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Furthermore, as part of our cybersecurity management, we are committed to strong third-party risk management. We actively and routinely address cybersecurity capabilities with our top-tier suppliers and have implemented cybersecurity requirements in our standard supplier contract terms to address cybersecurity risk. Additionally, we validate cybersecurity practices of key suppliers as may be necessary to comply with applicable regulations or flow-down requirements from our customers.


text: We maintain a cyber insurance policy, we periodically meet with our insurance broker and insurer to discuss emerging trends in cybersecurity and we utilize self-assessment tools and other services provided by our insurance broker and insurer, including annual tabletop exercises conducted by cybersecurity experts.

companyName: Mid-America Apartments, L.P.


text: The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. At a management level, our cybersecurity risk management program is led by our Chief Technology and Innovation Officer who has over 20 years of experience providing business and information technology, or IT, process consulting and regulatory compliance services, including founding a cyber-security consulting and regulatory compliance firm and serving as Sarbanes-Oxley subject matter specialist for an international public accounting firm, and whose certifications include Certified Public Accountant and Certified Information Systems Auditor. Partnering with our Chief Technology and Innovation Officer is our Vice President Cyber Security, who has over 30 years of IT technical and IT business process experience and has been an IT and cyber security leader for multiple financial services companies. Collectively, our cybersecurity team consists of 5 professionals with an average cybersecurity tenure of 15 years and various relevant certifications. Members of our cybersecurity team deliver regular updates to our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel.


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a cybersecurity incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for eight years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Under our Cyber Program, our Senior Director, Global Security, and the staff, along with our management-led Cybersecurity Committee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in various Company policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Audit Committee and Board, informed. Pertinent policy and practice documents include, among others, Manhattan's Incident Response Policy, our Incident Escalation Matrix, our Materiality Determination Process for Cybersecurity Incidents (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.


text: Management works primarily with third parties (principally professional services and consulting firms) to assist them in identifying, assessing, and managing cybersecurity risks. To operate its business, the Company utilizes certain third-party service providers to perform a variety of functions and seeks to engage reliable, reputable service providers that maintain cybersecurity programs. The Company is not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Our Vice President Information Technology, or VP IT, and Senior Information Security Manager, or Senior ISM, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cyber incidents if any occur. Our VP IT has a bachelor's degree in management information systems and more than 25 years experience managing enterprise information-technology systems and resources. Our Senior ISM has an undergraduate degree in management information systems, an MBA and multiple professional cybersecurity certifications, has specialized in cybersecurity for more than a decade and is focused primarily on cybersecurity.

companyName: IMPINJ INC

ticker: PI


text: Our VP IT and Senior ISM provide periodic briefings to the audit committee and to the board of directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Chief Compliance Officer and to our audit committee chair.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo ' s risk management program, including with respect to cybersecurity, which is a critical component of Apollo ' s overall approach to enterprise risk management ("ERM"). Apollo ' s cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo ' s overall ERM approach, Apollo ' s cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo ' s risks, including its cybersecurity risks. Apollo ' s Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd. ("AHL"), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo ' s risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: C ybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance The AGM board of directors ' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo ' s information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo ' s risk management professionals, the AGM's Chief Security Officer ("CSO"), AGM's CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by AGM's CISO and has representation from Apollo ' s Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. AGM's CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM ' s board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, as well as from AHL ' s CISO, at least annually.


text: AGM ' s CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo ' s cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, AGM's CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: AGM ' s CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM ' s CISO for nearly eight years. AGM ' s CISO holds a master ' s degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo ' s peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo ' s cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 of Regulation S-K promulgated under the Exchange Act.

companyName: UNITIL CORP

ticker: UTL


text: Risk management and strategy The Company has a Cybersecurity Plan for assessing, identifying, and managing material risks from cybersecurity threats. The intent of the Cybersecurity Plan is to provide a proactive and systemic approach to meet the evolving requirements for cybersecurity and related compliance in the utility industry. The Cybersecurity Plan's objectives include: • adopting and using established cybersecurity standards and industry best practices; • protecting personally identifiable information; • protecting infrastructure operations, including Supervisory Control and Data Acquisition (SCADA) systems at electric substations and natural gas plants; • securing customers', employees', and the Company's data; • complying with North American Reliability Corporation Critical Infrastructure Protection Reliability Standards and standards for the protection of Bulk Electric System Cyber Systems; and • continually assessing and, as necessary, enhancing the Company's cybersecurity through a managed process integrated with the Company's risk management principles.


text: During the fiscal year ended, and as of, December 31, 2024, there were no risks from cybersecurity threats (including as a result of previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company (including its business strategy, results of operations, or financial condition).


text: The Board is responsible for oversight of the Company's ERM program, including risks from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. The Company's management generally provides the Board with updates on and assessments of ongoing and emerging risks from cybersecurity threats at regularly scheduled Board meetings.


text: The Company's cybersecurity management team is responsible for assessing and managing the Company's material risks from cybersecurity threats, including implementing the Cybersecurity Plan. The team includes the Company's Chief Technology Officer and Vice President of Information Technology (the "CTO"), the Director of Information Security and Cyber Operations, Manager of Cyber Security Operations and two Cyber Operations Engineers, all of whom have an educational background relevant to, professional experience in, or other expertise in cybersecurity. This team is supported by the Company's Information Technology department. The CTO holds a Master of Business Administration and a Bachelor of Science in Electrical Engineering with over 30 years of professional experience in the utility industry with extensive management experience in engineering, operations and information technology. The CTO also assumes responsibilities as the Company's Chief Information Security Officer and Chief Cyber Security Officer. The CTO has overall management responsibility for the Company's cybersecurity. The CTO reports to the Company's Chief Executive Officer. The Director of Information Security and Cyber Operations holds a Bachelor of Science in Computer Science and a Masters Certificate in Cyber Security with a concentration in Power Systems and has over 30 years of experience in the information technology field. The Director of Information Security and Cyber Operations has primary responsibility for the cyber security program including threat and vulnerability management, vendor security posture assessment, Industrial Control System (ICS) and SCADA infrastructure cyber security protection at electric substations and natural gas plants, as well as leading the Cyber Incident Response Team. The Manager of Cyber Security Operations has a Bachelor of Science in Information Technology and over 20 years of experience in various information technology and cyber roles.


text: The Company's cybersecurity management team assesses and manages the Company's material risks from cybersecurity threats through or by: • active monitoring of cyber threat alerts, warnings, advisories, notices, vulnerability assessments, incident bulletins, security briefings, reports and white papers from industry and national organizations, including: downstream Natural Gas Information Sharing and Analysis Center; Electricity Information Sharing and Analysis Center; Cybersecurity and Infrastructure Security Agency; and Federal Bureau of Investigation; • threat and vulnerability management; • vendor security posture assessment; • Industrial Control System and Supervisory Control and Data Acquisition infrastructure cyber security protection at electric substations and natural gas plants; and • leading the Company's Cyber Incident Response Team.


text: Also, in the event of a cybersecurity threat or cybersecurity incident, the Company's cybersecurity management team will investigate and perform impact analysis and, as necessary, the CTO will activate the Company's Cyber Incident Response Team. The Cyber Incident Response Team is a subset of the Company's Crisis Response Team, which has responsibility for operational and business resilience, as well as tactical and strategic response. A foundational aspect of the Crisis Response Team is prompt and comprehensive communications to all concerned parties, both internal and external, including direction for management to inform the Board about risks from cybersecurity threats.


text: With oversight from the Board of Directors, NNN's management is responsible for managing all cyber risks and overseeing NNN's security programs. Primary cybersecurity risk oversight has been delegated to the Audit Committee. The Chief Accounting and Technology Officer (the "CATO") oversees NNN's security programs and its Incident Response Policy and Plan and provides direct oversight and guidance to the technology team that manages NNN's day-to-day technology and cybersecurity operations. The CATO has been with NNN for over 25 years and has overseen NNN's information systems, including its cyber risk management program, for the last 15 years. The technology team has the appropriate educational background and certifications in the area of information security governance and technical controls, penetration testing and vulnerability assessments, incident response and digital forensics and secure systems design and architecture.

companyName: NNN REIT, INC.

ticker: NNN


text: The Audit Committee cybersecurity risk oversight role includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, and (iii) confirming management has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident. NNN's cybersecurity risk profile and cybersecurity program status, including results of any third-party evaluations are reported to the Audit Committee by the CATO.


text: NNN's information systems process and store critical and sensitive NNN data. Management and the Board of Directors are committed to protecting NNN systems and data through layered perimeter, interrogation and access controls, as well as following a constant process of researching, assessing, patching and remediating. Processes to assess, identify, isolate, remediate and manage cybersecurity risks have been integrated into NNN's overall risk management system. Below are examples of actions NNN takes to protect NNN's information systems and data from cybersecurity risk: • Align systems and processes with best practices, including the National Institute of Standards and Technology Cybersecurity Framework, for securing NNN information systems and data; • Perform continuous systems monitoring and tactical measures for impending viruses, malware, tampering, exploits and other cyber threats; • Deploy systems tools to detect, prevent and neutralize cyber threats; • Engage independent third-party consultants to assist in evaluating cybersecurity risks and response profile and plans; • Identify, oversee and evaluate the risks associated with third-party service providers and consultants; • Continuously educate and provide procedural training to all associates and the Board of Directors regarding cybersecurity awareness and risks such as enterprise security, malware, data protection best practices, anti-phishing exercises and updates with respect to other implemented information security measures; • Periodically measure the effectiveness of associate training; • Cybersecurity risk management is periodically reviewed with NNN's Enterprise Risk Management Team; • Perform ongoing internal and external penetration testing and vulnerability assessments with a high priority for timely remediation; and • Establish reporting deadlines and hierarchies so that data regarding an incident or possible incident is communicated in a timely manner to NNN's management, to the Audit Committee of the Board of Directors, and if, appropriate or required by law, to the Commission.


text: Management is aware that preventive measures cannot prevent all cyber incidents. The CATO has direct oversight over the Company's security programs on a daily basis. When a cyber incident occurs, NNN's actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties and the Audit Committee Chairperson, (iv) recover any compromised NNN data and information systems, (v) limit impacts of any such incident on NNN's operations, and (vi) report any such incident as require by law or as otherwise necessary. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.


text: Risk Management and Strategy As is the case for similar companies of our size and industry, we may be the target of cyber attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience, including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors, and individuals. In addition, the advancement of AI has given rise to additional vulnerabilities and potential entry points for cyberattacks. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure, and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our CSO and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance, and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect, and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 34 years of experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board of directors performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for assisting the board of directors in reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board of directors, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: Cyber Risk Management and Strategy Under the board of directors'and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. Our internal audit team evaluates the results of these risk assessments to determine critical areas for audit as part of our annual internal audit plan. The results of the internal audits are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data are in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and monitor high-risk vendors on an ongoing basis, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.


text: Governance Related to Cybersecurity Risks Board oversight: Our board of directors has final oversight responsibility over cybersecurity-related matters. The full board of directors participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, internal audits, technological trends and information security considerations arising with respect to our peers and third parties.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board of directors.


text: As appropriate, the board of directors also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.


text: Our CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 12 years.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store sensitive data, including IP, proprietary business information of ours and that of our suppliers and licensees, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our licensees and third-party providers also possess certain of our sensitive data. The secure maintenance of such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, designed to identify, assess, help mitigate, and monitor IT risks across our organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party IT risk management, audit management, incident response and security awareness, including employee awareness trainings and other initiatives. Our ISMS includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks and related mitigations identified, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS and our broader information security program.


text: As part of our information security program, we also have processes in place for management of cybersecurity risks associated with third-party handling of our confidential information, including in such third parties' provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and ongoing monitoring of such third parties, utilizing tools such as security ratings services and periodic reassessment questionnaires.


text: Our information security team is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. This team works cross-functionally throughout our organization to assess and prepare the Company for identification and mitigation of, and if necessary respond to, information security risks. The information security team is led by our Chief Information Officer, who has over 35 years of experience in various information technology roles, including 18 years at the Company serving in roles with increasing levels of responsibility. Our Vice President of Information Security and Technology, a Certified Information Systems Security Professional, with over 20 years of global experience in various information security roles, including 14 years of experience at the Company, is responsible for day-to-day management of information security team initiatives. The other members of the information security team have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to IT and cybersecurity and mitigations put in place, or to be put in place, in response to such risks and opportunities. The audit and risk committee periodically reports to the full board of directors regarding its oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our CIO and Vice President of Information Security on our ISMS and other information security initiatives, and on our information security governance framework.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.

companyName: American Well Corp

ticker: AMWL


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 15 years of technology leadership experience.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.


text: The Company relies on our internal Technology Solutions team and third-party vendors to deliver effective and efficient services to our customers, process claims, and report information accurately and promptly to carriers. This often requires the secure handling of confidential, sensitive, proprietary, and other types of information. We actively monitor the risks associated with potential cybersecurity breaches of any of these systems. Therefore, we have made investments, and will continue to invest, in technology security initiatives, information technology policies, resources, and teammate training to mitigate the risk of unauthorized access to sensitive or personally identifiable information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full board of directors. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief security officer on the Company's latest information security risks and mitigation strategies.


text: The Company's chief security officer is responsible for developing and implementing our information security program. Our chief security officer has more than 35 years of experience in technology, operations, information risk and security. Our chief security officer has deep experience developing comprehensive information security programs for large and complex organizations. He also brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.


text: Our information security team deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: Internal persistent scans and external monthly scans;


text: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.


text: Additionally, external partners and products undergo a comprehensive security risk assessment process using our security scorecard tool, which evaluates data security risks and vulnerability maturity. Our teammates participate in an annual online security and compliance training program that includes testing. They are also subject to security awareness communications and random simulated phishing campaigns. Moreover, teammates are required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on their location. In 2024, nearly all Brown & Brown teammates completed ethical conduct training, cybersecurity awareness training, the California Consumer Privacy Act (CCPA) Survey, and the Annual Certification for Insurance Licensees training, which serves as a reminder of the regulatory obligation to report certain changes to the jurisdictions where they are licensed.


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our security operations center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions team for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the board of directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.


text: Risk Management and Strategy We understand the importance of identifying, assessing, and managing risks related to cybersecurity threats and data protection. We acknowledge the potential adverse effects of cybersecurity incidents on our business. As part of our enterprise risk management program, cybersecurity risks are evaluated alongside other company risks within the broader risk assessment process. Our data security plan incorporates a specialized cybersecurity risk assessment process, which helps us identify potential risks by benchmarking our procedures against National Institute of Standards and Technology (NIST) standards and engaging third-party experts to test the security of our information systems. Key aspects of our risk management program include: • Monitoring Regulatory Changes: We monitor emerging data protection laws and, if necessary, implement changes to our policies and employee training processes. • Cybersecurity Policy Reviews: We regularly review and update (when applicable) our policies and procedures related to cybersecurity. • Security Tools and Response Exercises: We use various tools, such as network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to assist in risk identification and assessment. We then use these findings (where applicable) to enhance our processes and technologies. • Employee Training: We conduct annual cybersecurity awareness training for all employees with computer access, as well as specific training for those who handle sensitive data or are involved in cybersecurity management. • Expert Collaboration: We work with third-party subject matter experts to assess cybersecurity threats, their severity, and potential mitigation strategies. • Safeguard Third-Party Data: Through policy, practice, and contracts (as applicable), we require employees, as well as third parties providing services on our behalf, to treat customer information and data with care. • Use of Third-Party Service Providers: As cybersecurity considerations affect the selection and oversight of our third-party service providers, we also conduct pre-engagement assessments for third-party providers based on the sensitivity of the data they handle, and annually review SOC 1 or 2 reports for certain outsourced service providers whose systems are utilized in processing company or employee data. • Phishing Simulations: Regular phishing simulations help employees recognize and respond to potential email threats, with additional training provided, as necessary • NIST Framework: We leverage the NIST incident handling framework to guide our responses to actual or potential cybersecurity incidents, covering identification, protection, detection, response, and recovery.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Cybersecurity Incident Response Process Our incident response plan outlines the steps we take to prepare for, detect, respond to, and recover from cybersecurity incidents. This process includes assessing severity, escalating, containing, investigating, and remediating incidents, while ensuring compliance with applicable legal obligations and protecting our brand reputation. As part of this process, we regularly engage with third-party assessors and consultants to review and improve our cybersecurity program, focusing on compliance and areas for improvement. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity specific risk identification program, both of which are discussed above.


text: Oversight of Cybersecurity Risk Our cybersecurity risk management strategy is led by the Information Technology Director (IT Director) and the Director of Information Security (IS Director). Our IS Director has over eleven years of experience managing information security, developing cybersecurity strategy and implementing relevant and effective cybersecurity programs. Together, our IT Director and IS Director hold numerous credentials, including a Bachelor of Science in Cybersecurity & Information Assurance. Both have extensive experience in cybersecurity management with credentials including CISSP, CCSP, GIAC, GCFA, GCIH, and others.


text: The IT Director reports directly to the Chief Financial Officer, ensuring timely notification of significant cybersecurity incidents to the senior management team. The management team and the enterprise risk committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The enterprise risk committee, which includes the Chief Financial Officer, IT Director as well as other members of senior management, review cybersecurity risk management as a component of our overall enterprise risk management.


text: The audit committee of the board of directors is responsible for the oversight of the company's enterprise risk management program. The audit committee's oversight includes reviewing and discussing with management (at least annually) management's report on assessment of risk exposure and risk management, the processes in place to identify and manage significant risks, steps taken by management to control or mitigate such exposures, and management's report on cybersecurity risk management, which includes strategies to mitigate data protection and cybersecurity risks. Additionally, the IT Director reports at least annually to the audit committee on cybersecurity threat risks, and our Chief Executive Officer reports regularly to the chair of our board of directors, and the full board of directors, as appropriate, about emerging threats to our operations, both at scheduled board meetings and through communications between board meetings. Pursuant to the company's incident response plan, if a significant cybersecurity incident occurs that may have a material effect on the company's business or its financial statements, management will discuss the incident and management's mitigation and remediation plan for such incident with the audit committee. As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial results, or long-term financial condition. For more information on cybersecurity risks, see the risk factor entitled "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" in Part I – Item 1. Business, Item 1A. Risk Factors contained in this report.


text: Cybersecurity Risk Management and Strategy We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Executive Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including a biennial maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; • policies to establish requirements for protecting information assets and defining acceptable behaviors to ensure compliance, mitigate risks, prevent unauthorized access, and foster a culture of security awareness and accountability, thereby enhancing the organization's overall security posture; and • a third-party risk management process for service providers, suppliers, and vendors.


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Executive Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.


text: Our management team, including our Global Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, law enforcement, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Operating Officer and Chief Information Officer, Chief Risk Officer, General Counsel, Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S. in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from information technology ("IT"), operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: Our Information Technology Security Team, under the oversight of our Senior Vice President and Chief Technology Officer and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President and Chief Technology Officer and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan. This plan was developed with support from our Audit Committee and in consultation with key stakeholders across our organization to ensure it accurately reflects their respective roles and responsibilities. The plan has been selectively disseminated throughout our organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect our information and data and alert us to potential information security breaches. The third party engaged by us to oversee and host our network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.


text: We previously engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and worked with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means.


text: While we have not experienced any cybersecurity incidents to date, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity incidents in the future. For additional information, see "Item 1A. Risk Factors—Risks Related to Our Business and Operations—We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business" in this Annual Report on Form 10-K.


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security and provide technical oversight. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate levels of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.


text: 6. Risk Monitoring and Review - Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the Form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.