text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, data theft, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - WE ARE SUBJECT TO CYBERSECURITY AND INFORMATION TECHNOLOGY RISKS RELATED TO BREACHES OF SECURITY PERTAINING TO SENSITIVE COMPANY, CUSTOMER, EMPLOYEE AND VENDOR INFORMATION AS WELL AS BREACHES IN TECHNOLOGY USED TO MANAGE OPERATIONS AND OTHER BUSINESS PROCESSES. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.


text: Engagement of Third Parties The Company engages third parties in connection with assessing, identifying and managing its cybersecurity risks, including the following: • Engagement of an independent third party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist the Company with preparing for, preventing, investigating, responding to and remediating cybersecurity incidents, including attacks that target on-premise, cloud, and critical infrastructure environments. • Engagement of an independent third party to conduct an annual security program assessment of the controls, maturity and performance of the Company's information security program and the information security risk associated with the Company's business systems. The assessment uses the National Institute of Standards and Technology Cybersecurity Framework as its benchmark. • Engagement of a leading third-party service provider to annually perform an external and an internal penetration assessment using industry standard tools and techniques. Additionally, our Internal Audit team conducts annual assessments of our cyber programs and controls.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP

secItem: Item 1C


text: Oversight of Third Parties The Company has processes to oversee and identify material risks from cybersecurity threats associated with the Company's use of third-party service providers. In this regard, the Company's cybersecurity risk management program takes into account third-party systems whereby the Company could be impacted by the compromise of the security of vendors or other business relations of the Company, and the Company has a comprehensive third-party access management system. In addition, the Company conducts risk-based due diligence on the profiles of third-party service providers with respect to cybersecurity risks prior to engagement, and providers of critical services are continuously monitored with respect to security risks. The Company also requires service providers to provide prompt notification of any actual or suspected breach impacting Company data or operations.


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.


text: Role of the Board of Directors and its Committees International Paper has an integrated board and executive-level governance structure that oversees risks from cybersecurity threats. The Company's Board of Directors has primary oversight of our enterprise risk management program, which includes cybersecurity risk. Moreover, the Board of Directors is supported in its oversight by the Audit and Finance Committee and PPE Committee, which share oversight responsibilities related to the Company's information security programs. The Audit and Finance Committee reviews management's cybersecurity and information security risk management programs and controls, including processes for management's identification and reporting of material cybersecurity incidents. The PPE Committee reviews technology issues pertinent to the Company including those associated with information and operational technology, cybersecurity and data security and assesses related Company strategies.


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, at least annually. Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to the Chief Information Officer who oversees the Company's information technology department.


text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing Information Security, Information Technology, Operational Technology, and Legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President of Human Resources, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts and chronology of events provided by the Incident Command Team.


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity risk management processes are integrated into our overall risk management system. The Company has a formalized enterprise risk management program overseen by the Board of Directors and committees of the Board of Directors that addresses strategic, operational, financial, compliance, legal and information technologies and cybersecurity risks. In addition, the Enterprise Risk Management Council ("ERM Council") is a management-level team comprised of senior vice presidents and other business leaders responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on the Company's business and financial results. The ERM Council regularly reports to the Board of Directors on areas of risk and risk management. The Chief Financial Officer serves as the ERM Council Lead. The Chief Audit Executive serves as the ERM Council Process Owner.


text: As part of our 80/20 strategic approach and our integration of DS Smith, the Company is evaluating how the ERM Council might operate in 2025 to ensure that our structure supports our strategic goals.


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with our enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. An enterprise Cyber Governance, Risk, and Compliance function manages overall Company cyber risk, coordinating risk management functions with each business. Business and IT leaders conduct cyber risk reviews monthly within each business. These monthly reviews include the evaluation of new and evolving risks, management of risk mitigation plans, and a review of all cybersecurity incidents meeting certain criteria.


text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, malware, phishing attacks, data theft, other data or security breaches, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders.


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - We are subject to cybersecurity and information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in technology used to manage operations and other business processes. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee at least annually regarding cybersecurity risks, as well as plans and strategies to mitigate those risks.


text: Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to our Chief Financial Officer. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Ethical Hacker, among others.


text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing information security, information technology, operational technology and legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President, Chief People and Strategy Officer, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review, and, if appropriate, may be further elevated for the review of the Board of Directors. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts gathered and chronology of events provided by the Incident Command Team.


text: Risk Management and Strategy We rely extensively and increasingly on information technologies and infrastructure to manage our business (including the digital storage of marketing strategies and client information), develop new business opportunities and digital products, and process business transactions. Digital services and products, advertising and marketing technology, e commerce services, data management and analytics and digital brand experience constitute a key part of our client offerings. Our business operations therefore depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Consequently, we maintain comprehensive policies and procedures designed to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), including our Chief Information Security Officer (CISO), each of whom has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal as well as third-party attack and penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including our accountants, independent assessors (for example, for penetration testing) of our cybersecurity program, external legal counsel and other consultants.


text: We have an incident reporting and escalation process designed to detect and analyze cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to an incident reporting call and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Executive Risk Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") and the Audit Committee of the Board of significant or material cybersecurity incidents, as appropriate. All incidents are documented and recorded and cataloged for further review by the CISO team.


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.


text: Our Board actively oversees Interpublic's risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies and performs an annual review and assessment of the primary operational and regulatory risks facing Interpublic, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO and CISO report to the full Board with a comprehensive report addressing a broad range of topics, including updates on strategy and investments, significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, industry trends, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: The Audit Committee oversees the design and operation of the Company's enterprise risk management program, including, in conjunction with the Board, oversight of its cybersecurity framework and the strategy, policies and practices implemented by the organization to appropriately mitigate such risks. Such oversight includes discussions with management and the Company's internal auditors on the magnitude and steps taken to address and mitigate any such risks. As a regular part of its meetings, risks related to cybersecurity are reviewed by the committee as part of the internal and external audit reports to the committee.


text: Interpublic's senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO and CISO have primary responsibility for managing our cybersecurity program and efforts. They work closely with key stakeholders, including internal committees such as the information security steering committee, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for the testing and audit of our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency. More generally, our Executive Risk Committee has primary responsibility for overseeing the Company's risk framework and the material risks facing our Company.


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and training and certification such as Digital Directors Network, Qualified Technical Expert training and certification, National Association of Corporate Directors (NACD) certification, Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and BCS certification, as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.


text: RISK MANAGEMENT AND STRATEGY We are subject to various cybersecurity risks in connection with our business. For additional information, see Item 1A — Risk Factors. As part of our overall enterprise risk management system and processes, we assess, identify and manage material risks from threats to our information systems. Once risks are identified, our Enterprise Risk Management Committee ("ERM Committee"), which consists of executives appointed by the Board, oversees and reviews these risks and provides an annual report regarding such risks to the Audit Committee for further review and evaluation. We also maintain processes to oversee and identify risks from cyber threats associated with our use of third-party service providers, including annual reviews of third-party SOC1 reports.

companyName: Rayonier, L.P.


text: Safeguarding our operations against cyber threats is a high priority. Recognizing the importance of a strong posture towards cyber threats, our strategy to combat the evolving threat landscape and support the protection of sensitive information includes engaging in: • Incident Response Planning and Data Backups. We maintain and regularly review a detailed incident response plan to help minimize downtime and disruption in the event of a cybersecurity incident and to assess materiality and any related disclosure obligations. We also actively maintain data backup procedures for business continuity in the event of a cybersecurity incident. Examples of our backup procedures and systems include daily server snapshots, database log files, Salesforce backups, and Google Vault. Generally, these backups of critical systems would allow us to restore operation within hours. • Third-Party Managed Monitoring, Detection, and Response Services. We partner with a reputable third-party firm for 24/7 threat monitoring, detection and response. • External Cybersecurity Process Assessments. We also engage third-party experts to conduct periodic process assessments against the U.S. National Institute of Standards and Technology ("NIST") framework to help us evaluate and enhance our cybersecurity practices. • Penetration Testing and Phishing Simulations. We periodically engage experts for penetration testing to identify system vulnerabilities and to simulate real-world cyberattacks. We also conduct quarterly phishing simulations to test our staff's response and to deliver targeted cyber awareness training. • Continuous Improvement and Adaptation. We regularly review and update our strategies to keep pace with the dynamic cyber threat landscape, and to build a resilient and responsive cybersecurity system. Our employees receive monthly training on data protection, threat detection, and incident response. We also provide a forum for employees to report cyber "near misses" to elevate cyber threat awareness across our organization.


text: In the past, we have experienced targeted and non-targeted cybersecurity attacks and incidents, and we could in the future experience similar attacks. To date, no cybersecurity attack or incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Our Director of Information Technology and our Manager of IT Security, having a combined 45 years of information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers.


text: In the event of a breach or incident, our Director of Information Technology leads our response to mitigate impact and initiate the recovery processes. Following the identification of a breach or incident, the Director of Information Technology reports incidents of a medium or high severity level2 to our senior leadership team. Incidents of a high severity level are also reviewed by our Disclosure Committee to assess materiality and any disclosure obligations. All incidents are reported to the Audit Committee at the next scheduled Board meeting, and incidents of high severity level are immediately reported to the Audit Committee.


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity dashboard, featuring key metrics such as threat detection rates and response times. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help to ensure that the Committee remains well-informed and proactive in their oversight of cybersecurity risks.


text: (1)Our Director of Information Technology has more than 25 years of IT experience. He joined the company in 2000 as an application developer and has held multiple positions of authority including project management and IT operations management. He holds a bachelor's degree and MBA from the University of South Carolina.


text: Our Manager of IT security has more than 20 years of IT experience. He joined the company in 2015 as a Systems Engineer and was promoted to his current position in 2020. Prior to joining Rayonier, he worked as an Infrastructure Engineer at Enterprise Integration (EI), a managed services provider. Prior to joining EI, he held various IT roles in support and engineering.


text: (2) A medium severity incident level is defined as incidents that have a moderate impact on business operations or data integrity and might affect internal systems and could potentially lead to limited unauthorized access to sensitive information. A high severity incident level is defined as incidents that pose a significant threat to business operations, data integrity, or confidential information. This level of incident may have legal, regulatory and public relations implications.


text: Our Director of Information Technology and our Manager of IT Security, having over 45 years of combined information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers. Our Director of Information Technology and Manager of IT Security also report material risks from threats to our information systems to the ERM Committee.


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity report, featuring key metrics and threats. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help the Committee remain well-informed and proactive in their oversight of cybersecurity risks.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is documented in our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, interconnectivity with business networks, system access controls and monitoring, and data back-up and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to merging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and issued to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual Code of Conduct and privacy training programs.


text: Third-party risk management is a critical component of our security strategy. We maintain oversight of service providers through a proactive monitoring approach, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers for maintenance of effective security management programs, compliance with information handling and asset management protocols, and require prompt notification of known or suspected cyber incidents.


text: To validate our security posture, we engage independent external parties to conduct regular penetration testing and security audits, and to provide cybersecurity consulting services. We maintain ISO 27001 certification for our global enterprise. Additionally, our IT General Controls (ITGC) undergo annual testing through Sarbanes-Oxley audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. Specifically, the Board is assisted by the Audit Committee and the ESG and Risk Committee, which oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks, and reports to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the ESG and Risk Committee. These presentations cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board, the Audit Committee and the ESG and Risk Committee regularly discuss cybersecurity and information security risks with our senior executives. As part of our cybersecurity governance, we also utilize a Cybersecurity Steering Committee comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as appropriate, to review, assess and direct decisions related to cybersecurity and information systems matters.


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer (CIO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following certifications: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), am FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly report directly to the Board, the Audit Committee and the ESG and Risk Committee on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate incidents. In addition, in the event of an incident, we intend to follow our incident response procedures that include notification processes to inform senior management and the Board of Directors and provide ongoing updates regarding any such incident until it has been remediated as appropriate.


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.


text: The Company maintains a commitment to cybersecurity using a combination of policy, technology, and training across the corporation. Emerging threats and regulatory compliance require regular monitoring and maintenance of the information technology environment, which the Company accomplishes by using internal resources, contracted partners, and industry-standard practices to meet security goals. These include implementation of technical controls such as National Institute of Standards and Technology ("NIST") SP 800-53 and NIST SP 800-171, and adherence to guidelines including Sarbanes-Oxley and the U.S. Department of Defense Federal Acquisition Regulation Supplement ("DFARS"). To address the risks to our information technology systems and data and as part of our Corporate Enterprise Risk Management program, we manage an information security program, which is designed to comply with the Department of Justice's CMMC requirements, maintain strong incident reporting capabilities and perform daily off-site backups. Additionally, we have implemented business continuity plans and security precautions for our critical systems, including establishing a back-up data center.

companyName: KAMAN Corp


text: The Company's cybersecurity protections are based on layered technologies supporting trained employees. Periodic testing of networks, systems, and personnel is performed to validate implementation and effectiveness of controls. Penetration testing, internal and external audit and annual review of policies and response plans are designed to provide a cybersecurity governance framework and independent verification that the Company maintains effective cybersecurity controls. Our information security team regularly monitors our network for anomalous activity and indications that track threat advisories from government security services, such as the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Administration as well as commercial cybersecurity companies and information technology vendors. Automated tools and our third-party Security Operations Center provide alerts to our information security staff regarding potential threats.


text: We perform annual assessments of information technology risk, including threats associated with our third-party service providers. We conduct diligence on all third-party providers we work with to evaluate their security practices consistent with our security principles, including compliance with regulatory and industry controls such as NIST 800-53 and System and Organization Controls reports. Cybersecurity risks, both internally and from third-party providers, are tracked quarterly as part of the Corporate Enterprise Risk Management program.


text: As of the date of filing, there are no material risks from cybersecurity threats, including those resulting from previous incidents, that have or are reasonably likely to have a material impact on our business strategy, results of operations or financial conditions. Refer to Item 1A, Risk Factors, for further information and a discussion of a previous cybersecurity incident identified at the Company.


text: The Audit Committee of the Board of Directors oversees the Company's business risk assessment framework and identifies principal business risks confronting the Company, including cybersecurity issues. The Audit Committee also reviews and discusses with management the Company's cybersecurity, data protection and information technology risks, controls and procedures and the Company's plans to mitigate those risks. The Audit Committee discusses cybersecurity risks and exposures periodically with management as well as internal and external auditors. The VP, Information Technology and our internal audit team provide the Audit Committee with quarterly or as needed updates on the performance of our program and information security matters and risk.


text: The VP, Information Technology, along with the information technology organization, is primarily responsible for the assessment and management of material risks from cybersecurity threats. This individual is responsible for briefing our executive officers and their direct reports about information technology threats to the organization and recommended courses of action. The Company's cybersecurity incident response plan includes measures for communicating with executive leadership about prevention, detection and remediation of identified information technology incidents.


text: Members of the information technology organization, including the VP, Information Technology, directors and managers, maintain cybersecurity credentials, such as Certified Information Security Manager ("CISM"), Certified Information Systems Security Specialist ("CISSP"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE"), as well as technology-specific qualifications for infrastructure and security used in the IT environment.


text: Cybersecurity Risk Management and Strategy Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management (ERM) program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer (CISO) responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.

companyName: KELLY SERVICES INC

ticker: KELYA


text: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company's assets and operations. In addition to our internal information security team, we rely on services from various third parties, including a Managed Security Service Provider (MSSP) and services from an IT solutions organization. To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework (NIST CFS) and is assessed against NIST CFS by a third-party firm at least annually. We use the assessment, reviews and exercises to ensure that the Company's information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor SOC 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.


text: Cybersecurity Threats Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.


text: Despite security measures, unforeseen exploits create an inherent risk of cyberattacks that could materially affect our operations without notice. An event involving the destruction, modification, accidental or unauthorized release, or theft of sensitive information from systems related to our business, or an attack that results in damage to or unavailability of our key technology systems or those of critical vendors (e.g., ransomware), could result in damage to our reputation, fines, regulatory sanctions or interventions, contractual or financial liabilities, additional compliance and remediation costs, loss of employees or customers, loss of payment card network privileges, operational disruptions and other forms of costs, losses or reimbursements, any of which could materially adversely affect our operations or financial condition. Our cyber security and business continuity plans, and those of our third parties with whom we do business, may not be effective in anticipating, preventing, or effectively responding to all potential cyber risk exposures. Our insurance coverage may not be sufficient to cover all such costs or consequences, and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.


text: Our Board of Directors oversees consideration of strategic risks to the Company as well as managements actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Enterprise Risk and Privacy Officer, and Audit Committee Chair of the Company's Board of Directors review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary, with each committee chair and other directors (including the CEO) of the Company's Board of Directors, the Company's chief people officer, chief financial officer and general counsel. The Chief Enterprise Risk and Privacy Officer holds similar quarterly reviews with the Company's CEO and executive officers. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team (EMT), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, the CIO, and Chief Enterprise Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. The CISO reports directly to the Chief Information Officer (CIO) and has served in the CISO role since its creation in 2021 and in similar roles with the Company since 2011. The CISO has more than 30 years of experience in the information technology field, including more than 20 years of experience helping secure organizations in the professional services, manufacturing and US Intelligence/Department of Defense sectors. He holds a BS in Business/Information Systems. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.


text: Cybersecurity Risk Management and Strategy Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management ("ERM") program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer ("CISO") responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.


text: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company's assets and operations. In addition to our internal information security team, we rely on services from various third parties, including a Managed Security Service Provider ("MSSP") and services from an IT solutions organization. To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") and is assessed against the NIST CSF by a third-party firm at least annually. We use the assessment, reviews and exercises to ensure that the Company's information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor System and Organization Controls ("SOC") 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.


text: Cybersecurity Threats Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes, and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.


text: Our board of directors oversees consideration of strategic risks to the Company as well as management's actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Information Officer ("CIO"), Chief Risk and Privacy Officer, General Counsel, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO"), and other officers review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary. The Company's Chief Risk and Privacy Officer, CISO, Vice President of Internal Audit and certain members of this management team and select members from their teams convene monthly to manage cybersecurity and privacy governance. The Chief Risk and Privacy Officer holds similar quarterly reviews with the Audit Committee Chair of the Company's Board of Directors, each committee chair, and other directors including the CEO, CFO, and General Counsel. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team ("EMT"), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, CIO, and Chief Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. Our CISO has over 20 years of experience in information security and security engineering at various technology and staffing companies. The CISO reports directly to the CIO, who has over 30 years of experience serving as Chief Information Officer, Director of IT, and other roles in corporate information technology at staffing and technology companies. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.

companyName: KENNAMETAL INC

ticker: KMT


text: We closely oversee risks associated with using third-party service providers. This involves evaluating their adherence to our security requirements, conducting technical assessments, monitoring their operational performance and establishing incident reporting protocols when our information is impacted by cyber incidents.


text: Despite our efforts, we acknowledge the potential impact of cyber threats on our operations and business. While the Company has not experienced any significant risks from cyber threats to date, we recognize the potential consequences, including operational disruptions, legal costs, damage to our reputation and financial impacts. We remain vigilant and proactive in managing these risks. We deploy state-of-the-art technologies and services to help us identify and respond to security incidents, manage a 24/7 Security Operations Center and regularly test our preparedness for cyber incidents. These efforts enable us to effectively recognize and respond to low-impact incidents, avoiding their escalation to more problematic situations.


text: The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.


text: Management, led by the Chief Information Security Officer (the "CISO"), plays a crucial role in assessing and managing cybersecurity risks. The CISO holds a Master of Science in Information Security and Assurance along with other technical certifications, has over 20 years of experience in cybersecurity and has extensive experience managing cybersecurity programs in multinational manufacturing companies. The IT Risk Management Committee, under guidance of the CISO, oversees the assessment and mitigation of identified risk. Regular reporting mechanisms keep the Board of Directors of the Company informed about our cybersecurity posture and emerging risks; enabling informed decision-making regarding cybersecurity strategy and resource allocation.


text: Risk Management and Strategy. We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.


text: Governance. The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. Our cybersecurity program includes systems and processes for assessing, identifying, and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls, information systems configuration management and infrastructure security systems. We also have implemented processes to oversee and identify such risks from cybersecurity threats associated with the use of third-party service providers. We conduct periodic testing of these controls and systems, including vulnerability scanning and penetration testing. We strive to foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: We currently do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial conditions. While we do not believe that any such risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company in the future. See Item 1A, Risk Factors, for more information on our cybersecurity-related risks.


text: On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. They periodically review and discuss with management, including the Company's Vice President of Information Technology and Engineering, the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures. The Board of Directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's Vice President of Information Technology and Engineering leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. See Item 10, Directors, Executive Officers and Corporate Governance, for more detail on his education and experience. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • third party engagements to perform periodic penetration testing and reviews of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.


text: Additional information on cybersecurity risks we face is discussed in Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.


text: Internal Cybersecurity Team Our Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture;


text: KIMBERLY-CLARK CORPORATION - 2023 Annual Report • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.


text: Our CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST cybersecurity framework.


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the Russia invasion of Ukraine in March 2022.


text: As a global company serving consumers in more than 175 countries and territories, we routinely experience a wide variety of cybersecurity incidents. However, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect our business strategy, results of operation or financial condition. For a more detailed discussion of the risks we face, see Item 1A, "Risk Factors."


text: Incident Response We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. The plan also includes a materiality assessment framework that sets forth procedures to support our assessment of whether a security incident is "material" under the federal securities laws. Internal reporting and escalation protocols are in place to ensure the involvement of the CISO, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we regularly conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: Our Board of Directors has delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee receives quarterly reports from our CDTO and our CISO covering cybersecurity risks, strategic programs for managing cybersecurity risk, emerging trends and operational and policy compliance metrics.


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 26 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our CISO has served as a chief information security officer or equivalent role at large public and private companies for over 16 years. Our CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • deployment of best in-class solutions to enhance our security posture; • penetration testing performed by a dedicated specialized team that is supplemented with periodic third-party engagements; • periodic third-party reviews of program maturity are conducted based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.


text: KIMBERLY-CLARK CORPORATION - 2024 Annual Report Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.


text: Internal Cybersecurity Team Our interim Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture; • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.


text: Our interim CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the war in Ukraine.


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 27 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our interim CISO has served in various information technology roles for over 20 years. Our interim CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our interim CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.


text: Risk Management and Strategy The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, education of employees to the risks of external threats, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers.

companyName: KOSS CORP

ticker: KOSS


text: Annual vulnerability assessments and penetration testing, as well as periodic web application scanning, is performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also recently partnered with a breach protection platform to provide security and phishing training to its employees.


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations or financial conditions.


text: The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.


text: Risk Management and Strategy The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, implementation of a formal policy related to employees that access corporate systems from personal devices, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers. Enhancements have also been made to endpoint protection and remote access protocols, including enhanced encryption, two-factor authentication (2FA) and real-time threat monitoring.


text: Annual vulnerability assessments and penetration testing, as well as periodic web application and internal network scanning, are performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also partners with a breach protection platform to provide ongoing, self-guided cybersecurity training to its employees to reduce risk from phishing, social engineering and password-related attacks.


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations, customer relationships or financial conditions.


text: Cybersecurity remains a critical component of corporate governance at the Company. The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs, training metrics, system health status and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity risk management program has been informed by industry standards, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, policies, guidelines, procedures, infrastructure, and systems that are designed to protect the confidentiality, integrity and availability of our critical systems and information.


text: Elements of our cybersecurity risk management process include, but are not limited to, the following: • Annual cybersecurity risk assessments of critical infrastructure and systems; • Annual vulnerability scans and penetration testing; • Mandatory, bi-annual cybersecurity awareness training for all employees, including phishing exercises; and • An overarching written information security policy and written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We leverage IT service providers to perform penetration testing and support our cybersecurity awareness training program. We oversee cybersecurity risks related to third-party IT cloud service providers who have access to our systems and data. We require certain IT cloud service providers to complete cloud-based cybersecurity assessments.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced cybersecurity threats and other security incidents that have affected our information or systems. We have experienced, and expect to continue to be subject to, cybersecurity threats and incidents, ranging from employee error or misuse to individual attempts to gain unauthorized access to information systems, to sophisticated and targeted measures known as advanced persistent threats, none of which have been material to the Company to date.


text: For additional information on certain risks associated with cybersecurity, including with respect to prior cybersecurity incidents, please refer to "We may be subject to disruptions or failures in our information technology systems and network infrastructures that could have a material adverse effect on us" in Item 1A: Risk Factors.


text: Cybersecurity Governance Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Vice President of Information Technology ("VP of IT"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.


text: The VP of IT has twenty seven years of experience in information technology, fifteen of which have involved IT leadership for various organizations. Our Director, IT Governance and Security (the "Director, IT") reports to our VP of IT and is responsible for the day-to-day management of our cybersecurity risk management program. The Director, IT has eighteen years of experience in information technology. The Director, IT receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity practices are aligned with standard industry frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, International Organization for Standardization (ISO) 27001, Center for Internet Security Critical Security Controls and other industry standards.


text: Cybersecurity Governance Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Senior Director of Governance & Information Security (the "Senior Director, GIS"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.


text: The Senior Director, GIS, who has been a head of information security for close to 15 years and has more than 27 years of overall experience in IT and cyber security industry, holds a Bachelor of Science in Information Technology from Bina Nusantara University and Master of Business Administration from University of Liverpool.


text: He receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.


text: Risk Management and Strategy The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: LA-Z-BOY INC

ticker: LZB


text: Third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and annually.


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company is not aware of any cybersecurity threat or any material cybersecurity incident to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Additionally, in Item 1A Risk Factors under the heading of "Operational Risk Factors," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.


text: Risk Management and Strategy The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on the Company's operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: We incorporate third-party expertise in various aspects of our cybersecurity program. One or more third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts annual tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in the technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and at least annually thereafter.


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discusses with the Board changes in assessment of these risks and mitigation plans.


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO, and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.


text: RISK MANAGEMENT AND STRATEGY We have processes to identify, assess, monitor, and manage material risks related to information technology, including cybersecurity threats, vulnerability management, incident management, data protection and retention, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.

companyName: MARZETTI CO

ticker: MZTI