text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. We maintain an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor, we are required to comply with extensive governmental regulations and standards regarding cyber security.

companyName: Lumen Technologies, Inc.

ticker: LUMN

secItem: Item 1C


text: We periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: We maintain an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of our Board of Directors. These escalation provisions, together with our disclosure controls and procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: Our Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to all security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team ("CSWAT"), which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: Our CSWAT is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including oversight by our Board of Directors, executive commitment and employee training. Our Risk and Security Committee, comprised of independent directors from our Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from our Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, our Risk and Security Committee provides reports to the full Board of Directors regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Our CSO has extensive experience working in the public and private sectors leading security organizations, risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Our cybersecurity organization includes a response team and management-level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include our Chief Financial Officer, Chief Technology and Product Officer, Executive Vice President of Enterprise Operations, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by our Board of Directors and our senior leadership team. Some of the more significant risks discussed by the ROC are also reported to our Risk and Security Committee at least quarterly.


text: We maintain a comprehensive process for detecting, assessing, and managing material risks from cybersecurity threats as part of our overall enterprise risk management system and processes. Our Chief Technology Officer ("CTO") oversees our Chief Information Security Officer ("CISO") and a dedicated team of information security professionals who are responsible for our cybersecurity risk management program. Our CTO oversees our information security professionals' efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents and the efforts for assessing and managing our material risks from cybersecurity threats. Our cybersecurity risk management program includes technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools, and related services from third-party providers. Our CTO has over twenty years of extensive experience in information technology and security.

companyName: Churchill Downs Inc

ticker: CHDN


text: We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not mean that we meet any particular technical standards, specifications, or requirements of the NIST CSF. We routinely engage consultants and other third parties to assist with our cybersecurity risk management, including third-party penetration tests of our various information technology environments. As part of our current due diligence review and contracting process with third-party vendors that may have access to our data or systems, we perform an information security review of the vendor's program and require such contracts to include certain minimum-security safeguards and notification requirements, where applicable. We also carry cybersecurity insurance with coverage for costs associated with a cybersecurity incident.


text: We have an established incident response plan to address and guide our employees and management on our response to a cybersecurity incident. The Company has two management committees that assist with cybersecurity incidents and risk management. These committees consist of senior leadership and cross-functional members from across our organization. The Consumer Data Privacy Committee assists with identifying and managing consumer data privacy issues. The Cybersecurity Disclosure Committee ("CD Committee") assists senior management in fulfilling their responsibilities for oversight of the accuracy and timeliness of disclosures made by the Company in response to cybersecurity incidents and vulnerabilities. In the event a potentially significant cybersecurity incident is identified by our information security team, such incident is reported to the CD Committee to consider applicable disclosures, with the assistance of outside counsel as needed. In addition, senior leadership prepares an enterprise risk management report identifying and evaluating enterprise risks, including cybersecurity risks, which is regularly presented to the Audit Committee.


text: Our executive leadership team, along with oversight from the Audit Committee of the Board of Directors, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. The Audit Committee oversees the processes by which management assesses the Company's exposure to cybersecurity risks and evaluates the guidelines and policies governing the Company's monitoring, control, and minimization of such risks. Our CTO regularly reports to the Audit Committee regarding cybersecurity matters. For additional information concerning cybersecurity risks we face, refer to Part I, Item 1A, Risk Factors.


text: We maintain a comprehensive process for detecting, assessing, and managing material risks from cybersecurity threats as part of our overall enterprise risk management system and processes. Our Chief Technology Officer ("CTO") oversees our Chief Information Security Officer and a dedicated team of information security professionals who are responsible for our cybersecurity risk management program. Our CTO oversees our information security professionals' efforts to prevent, detect, mitigate, and remediate cybersecurity and other emerging technology risks and incidents and the efforts for assessing and managing our material risks from cybersecurity threats. Our cybersecurity and risk management program includes technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools, and related services from third-party providers. Our CTO has over twenty years of extensive experience in information technology and security.


text: Our executive leadership team, along with oversight from the Audit Committee of the Board of Directors, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. The Audit Committee oversees the processes by which management assesses the Company's exposure to cybersecurity risks and evaluates the guidelines and policies governing the Company's monitoring, control, and minimization of such risks. Our CTO regularly reports to the Audit Committee regarding cybersecurity matters.


text: As of the date of this report, the Company is not aware of any cybersecurity risks that have, or are reasonably likely to, materially affect us, our business strategy, results of operation, or financial condition. Although we have invested in information security and monitor our systems on an ongoing basis, there can be no guarantee that such efforts will in the future prevent compromises to our information technology systems that could have a material adverse effect on our business. For additional information concerning cybersecurity risks we face, refer to Part I, Item 1A, Risk Factors.


text: Risk Management and Strategy As discussed further in Item 1, Regulation, Enterprise Risk Management, we manage cybersecurity as part of our overall enterprise risk programs.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: As part of this program to keep our systems and data secure and to assist in understanding, assessing, identifying and managing material risks from cybersecurity threats, we take various measures through internal risk management efforts and testing by third-party experts. Those measures assess our cybersecurity program structure and capabilities and include blocking attempted cyber intrusions, defending against service disruptions, performing frequent vulnerability assessments and maintaining procedures to ensure timely notification of critical cybersecurity incidents and performance of related disclosure controls. We also have developed procedures and reporting processes when we identify an attempted cyber intrusion to the systems of one of our independent agents.


text: Additionally, the company uses third-party service providers, or vendors, in the course of conducting its operations. As such, the company has measures in place to help identify material risks from cybersecurity threats associated with the use of those vendors. When work with a vendor is evaluated, we consider, among other items, the availability of system and organization controls reports, interactions with our systems, the data involved and its level of sensitivity, the amount of data the vendor will process, where the data will be stored, what they will do with the data and destruction of data. Once a vendor is approved by the appropriate personnel, expectations regarding incident reporting are established and followed.


text: We are not aware of having experienced a material cybersecurity incident and we take commercially reasonable measures, described above and below, to monitor and respond to threats to keep our systems and data secure. However, we acknowledge that administrative, technical and internal accounting controls as well as other preventative actions may be insufficient to prevent security breaches to our systems or those of third parties with whom we do business due to, among other factors, changing technologies as well as criminal and state-sponsored cybercrime and cyber threats. Further, a material breach of our security or the security of a vendor that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage and could affect the company's strategy, results of operations or financial condition. See Item 1A, Risk Factors, for additional details.


text: Cybersecurity matters are an important part of reporting to our board of directors, executive management team, risk committee and disclosure committee. From a board perspective, the audit committee oversees the company's cybersecurity efforts along with additional oversight from the entire board. Several members of the audit committee have obtained certifications in cybersecurity oversight. Each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls. Also occurring each quarter, the entire board, and our senior executive team, as appropriate, receives a comprehensive report from the chief risk officer on the status and management of risk and other metrics relative to identified tolerances and limits, risk assessments and risk plans. Additionally, the chief risk officer has direct access to all members of the board of directors and presents in person at board meetings twice each year.


text: At the executive management and management levels, the chief information security officer leads the process of assessing and managing material risks from cybersecurity threats. Our chief information security officer has over 25 years of experience as a technology professional with in-depth knowledge of IT management processes and holds multiple degrees and professional designations, including as a certified information systems security professional (CISSP). The chief information security officer also works in collaboration with our chief information officer and chief risk officer and is supported by a cross-functional group of qualified and experienced professionals across various committees and functions. On a quarterly basis, the chief information officer provides a cybersecurity update to the disclosure committee and, on a monthly basis, the information security office team delivers a cybersecurity report to the senior executive team. Also refer to Item 10, Directors, Executive Officers and Corporate Governance, for additional qualification, experience and responsibility details.


text: Cincinnati Financial Corporation - 2023 10-K - Page 43 Associates involved in this area stay informed of industry trends and evolving threats using various resources including government authorities, peers, continuous education, industry publications, news outlets and other external parties that provide pertinent information. We take administrative, technical and internal accounting control measures to protect against cybersecurity incidents, including actions to monitor for, prevent, detect, mitigate and remediate any incidents that occur. These measures and actions include endpoint controls, multi-factor authentication and general cybersecurity education directed at our workforce and independent agents.


text: From a monitoring perspective, generally speaking, our information security office associates monitor the environment for threats, events and potential incidents. Depending on the potential severity of any identified incident, the company's incident response process, modeled after National Institute for Standards and Technology (NIST) frameworks, is initiated. As part of this process, each incident is evaluated and inventoried by our incident response team and reported to our legal compliance subcommittee for further action. Depending on severity, certain other internal and external parties may participate in the incident response process from a compliance and financial reporting perspective.


text: Incidents, regardless of severity, are evaluated and documented and are shared with the audit committee. In 2023, the audit committee received four updates on matters related to cybersecurity. The process of evaluating and documenting individual incidents, even when not deemed material, assists in determining how previous incidents have or may reasonably likely have a material effect on the company in the future.


text: Additionally, the company uses third-party service providers, or vendors, in the course of conducting its operations. As such, the company has measures in place to help identify material risks from cybersecurity threats associated with the use of those vendors. When work with a vendor is evaluated, we consider, among other items, the availability of system and organization control reports, the use of artificial intelligence, interactions with our systems, the data involved and its level of sensitivity, the amount of data the vendor will process, where the data will be stored, what they will do with the data and destruction of data. Once a vendor is approved by the appropriate personnel, expectations regarding incident reporting are established and followed.


text: Cybersecurity matters are an important part of reporting to our board of directors, executive management team, risk committee and disclosure committee. From a board perspective, the audit committee oversees the company's cybersecurity efforts along with additional oversight from the entire board. Two members of the audit committee have obtained certifications in cybersecurity oversight. Each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls. Also occurring each quarter, the entire board, and our senior executive team, as appropriate, receives a comprehensive report from the chief risk officer on the status and management of risk and other metrics relative to identified tolerances and limits, risk assessments and risk plans. Additionally, the chief risk officer has direct access to all members of the board of directors and presents in person at board meetings twice each year.


text: At the executive management and management levels, the chief information security officer leads the process of assessing and managing material risks from cybersecurity threats. Our chief information security officer has over 25 years of experience as a technology professional with in-depth knowledge of IT management processes and holds multiple degrees and professional designations, including as a certified information systems security professional (CISSP). The chief information security officer also works in collaboration with our chief information officer and chief risk officer and is supported by a cross-functional group of qualified and experienced professionals across various committees and functions. On a quarterly basis, the chief information officer provides a cybersecurity update to the disclosure committee and, on a monthly basis, the information security office team delivers a cybersecurity report to members of the senior executive team. Also refer to Item 10, Directors, Executive Officers and Corporate Governance, for additional qualification, experience and responsibility details.


text: Cincinnati Financial Corporation - 2024 10-K - Page 41 Associates involved in this area stay informed of industry trends and evolving threats using various resources including government authorities, peers, continuous education, industry publications, news outlets and other external parties that provide pertinent information. We take administrative, technical and internal accounting control measures to protect against cybersecurity incidents, including actions to monitor for, prevent, detect, mitigate and remediate any incidents that occur. These measures and actions include endpoint controls, multi-factor authentication and general cybersecurity education directed at our workforce and independent agents.


text: Incidents, regardless of severity, are evaluated and documented and are shared with the audit committee. In 2024, the audit committee received four updates on matters related to cybersecurity. The process of evaluating and documenting individual incidents, even when not deemed material, assists in determining how previous incidents have or may reasonably likely have a material effect on the company in the future.


text: CNA's information security and data privacy programs are designed to protect the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems. These programs include processes that provide guidance for information security decision-making and risk management, and include standards to promote understanding and compliance with applicable laws and regulations. Administrative and technical safeguards that seek to mitigate cybersecurity threats and secure the Company's information assets are also addressed on a risk-based basis. We have designed our enterprise-wide information security programs consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework. These programs include processes implemented within our third-party risk management unit designed to identify, mitigate and monitor cybersecurity risk relating to vendors, suppliers and external partners who have access to our confidential information or our information systems. CNA engages both internal auditors and third-party information security experts in connection with reviewing such foregoing processes.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: CNA monitors information security metrics globally. To elevate this information within the organization, our Chief Risk & Reinsurance Officer (CRRO) and Chief Compliance Officer (CCO) present cybersecurity reports and metrics to the Audit Committee of our Board of Directors every quarter. Reports address security events, third-party risk and vulnerabilities, including material risks from cybersecurity threats, and any significant unauthorized occurrences. These discussions are part of our overall enterprise risk management and also take place on at least an annual basis with the full Board of Directors, which is responsible for overseeing material risks, including cybersecurity risk, on an enterprise-wide basis.


text: At the senior management level, our Chief Information Security Officer (CISO) oversees CNA's information security and data privacy programs and is responsible for establishing and implementing the security strategy alongside the Chief Information Officer (CIO), to whom the CISO reports directly. The CIO serves on the Enterprise Risk Committee, which is chaired by the CRRO.


text: The CISO leads the Information Security group within Information Technology, which manages the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for information technology security monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CISO and CIO together lead efforts to design, implement and operate controls deemed necessary, commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the organization. Our current CISO has a bachelor's degree in Computer Information Systems and a master's degree in Cybersecurity, and has over 20 years of experience building and executing information and cybersecurity strategies. Prior to joining CNA, our CIO served in a variety of roles at another major U.S. insurance company, both in business and technology, and has over 20 years of experience working with major U.S. Property & Casualty insurers.


text: Threats of security incidents and the impact of actual security incidents are initially assessed and managed by the CISO and CIO as described above. CNA has further implemented response plans that provide the basis for appropriate response to an unauthorized occurrence from a technical perspective, as well as from disclosure and regulatory perspectives.


text: These response plans also set forth the processes for internal reporting of a substantive unauthorized occurrence. The CISO reports such matters to the CIO and CCO, who is responsible for convening a team of cross-enterprise leaders to ensure comprehensive responsiveness to an occurrence. This group also analyzes unauthorized occurrences affecting CNA's or third parties' IT systems or sensitive information, and directs the activities of CNA in responding to such incidents.


text: In addition, the group, under the leadership of the CCO, undertakes the appropriate internal notifications of any such occurrence, and responsive activities, to the General Counsel, Chief Executive Officer, Chief Financial Officer and Board of Directors.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to "Any significant interruption in the operation of our business functions, facilities and systems or our vendors' facilities and systems could result in a materially adverse effect on our operations" and "Any significant breach in our data security infrastructure or our vendors' facilities and systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach" under Item 1A Risk Factors.


text: At the senior management level, our Global Chief Security Officer (CSO) oversees CNA's information security and data privacy programs and is responsible for establishing and implementing the security strategy alongside the Chief Information Officer (CIO), to whom the CSO reports directly. The CIO serves on the Enterprise Risk Committee, which is chaired by the CRRO.


text: The CSO leads the Information Security group within Information Technology, which manages the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for information technology security monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CSO. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CSO and CIO together lead efforts to design, implement and operate controls deemed necessary, commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the organization. Our current CSO has a bachelor's degree in Computer Information Systems and a master's degree in Cybersecurity, and has over 20 years of experience building and executing information and cybersecurity strategies. Prior to joining CNA, our CIO served in a variety of roles at another major U.S. insurance company, both in business and technology, and has over 20 years of experience working with major U.S. Property & Casualty insurers.


text: Threats of security incidents and the impact of actual security incidents are initially assessed and managed by the CSO and CIO as described above. CNA has further implemented response plans that provide the basis for appropriate response to an unauthorized occurrence from a technical perspective, as well as from disclosure and regulatory perspectives.


text: These response plans also set forth the processes for internal reporting of a substantive unauthorized occurrence. The CSO reports such matters to the CIO and CCO, who is responsible for convening a team of cross-enterprise leaders to ensure comprehensive responsiveness to an occurrence. This group also analyzes unauthorized occurrences affecting CNA's or third parties' IT systems or sensitive information, and directs the activities of CNA in responding to such incidents.


text: In addition, the group, under the leadership of the CCO, undertakes the appropriate internal notifications of any such occurrence, and responsive activities, to the General Counsel, Chief Executive Officer, Chief Financial Officer and Board of Directors, with executive management involvement in the same to the extent appropriate in the context of the nature of such occurrence.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to "Any significant interruption in the operation of our business functions, facilities or systems or our vendors' facilities or systems could result in a materially adverse effect on our operations" and "Any significant breach in our data security infrastructure or our vendors' facilities or systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach" under Item 1A Risk Factors.


text: Cybersecurity Risk Management and Strategy We face various cyber risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security threats through our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our broader Enterprise Risk Management ("ERM") program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: COCA COLA CO

ticker: KO


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our newly acquired businesses and consolidated bottling operations maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company's overall cybersecurity programs and processes. However, for all consolidated entities, our cybersecurity risk management program is designed to help coordinate the Company's identification of, response to and recovery from, cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as to comply with applicable legal obligations.


text: Our internal audit team assesses the effectiveness of our internal controls relating to cybersecurity. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. For example, we conduct tests that help discover potential vulnerabilities, including external penetration testing and tabletop and other exercises, to evaluate our core information systems and cybersecurity practices that enable improved decision-making and prioritization, as well as to promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's independent bottling partners, distributors, wholesalers, retailers and other business partners, as well as our use of third-party service providers, we maintain a third-party risk management program designed to help protect against the misuse of information technology. We have various processes and procedures to evaluate cybersecurity threats associated with third parties, including requiring key third-party service providers to complete initial and periodic security assessments. In addition, our Global Chief Information Security Officer ("CISO") and other senior leaders regularly meet with key bottling partners to discuss cybersecurity risks and mitigation programs in order to advance risk management capabilities and proactively share cybersecurity guidelines and best practices.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."


text: Cybersecurity Governance and Oversight The Company's cybersecurity risk management program is supervised by our CISO, who reports directly to the Company's Chief Information Officer ("CIO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current CISO received his Master of Business Administration degree from Columbia University and has over 20 years of cybersecurity experience, including relevant prior senior leadership positions held with three other large companies.


text: The CISO chairs the Company's Cybersecurity Oversight Council, a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The Cybersecurity Oversight Council is sponsored by the Company's Global General Counsel and CIO and is composed of senior leaders from our privacy, legal, information technology, cybersecurity, internal audit and global security and asset protection functions, among others. Subject matter experts are also invited, as appropriate. The Cybersecurity Oversight Council meets at least quarterly and has responsibility for oversight and validation of the Company's cybersecurity strategic direction, risks and threats, priorities, resource allocation, capabilities and planning. The Cybersecurity Oversight Council acts in alignment with the Company's Risk Steering Committee, another cross-functional management committee, which provides strategic direction and oversight over the Company's ERM program. The CISO and his team, as well as the Cybersecurity Oversight Council, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the Company's cyber incident response plan.


text: The Audit Committee of the Board of Directors is charged with oversight of cybersecurity matters and receives regular reports from the CISO and the CIO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In accordance with our cyber incident response plan, the Audit Committee is promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Chair of the Audit Committee regularly briefs the full Board on these matters. In addition, the Board also periodically receives cybersecurity updates directly from management.


text: In an effort to detect and defend against cyber threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.


text: Cybersecurity Risk Management and Strategy We face various cybersecurity risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity and information security threats through our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our broader Enterprise Risk Management ("ERM") program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our acquired businesses and consolidated bottling operations maintain separate cybersecurity systems and environments that may differ in scope and complexity from our own. However, for all consolidated entities, our cybersecurity risk management program is designed to help coordinate the Company's identification of, response to and recovery from, cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as to comply with applicable legal obligations.


text: Our internal audit team assesses the effectiveness of our internal controls relating to cybersecurity. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. For example, we conduct tests that help discover potential vulnerabilities, including external penetration testing and tabletop and other exercises, to evaluate our core information systems and cybersecurity practices that enable improved decision-making and prioritization, as well as to promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, the Company also maintains cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related incidents.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we have been the target of cyberattacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."


text: Cybersecurity Governance and Oversight The Company's cybersecurity risk management program is supervised by our CISO, who reports directly to the Company's Chief Information Officer ("CIO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current CISO received his Master of Business Administration degree from Columbia University and has over 25 years of cybersecurity experience, including relevant prior senior leadership positions held with three other large companies.


text: The CISO chairs the Company's Cybersecurity Oversight Council, a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The Cybersecurity Oversight Council is sponsored by the Company's Global General Counsel and CIO and is composed of senior leaders from our privacy, legal, information technology, cybersecurity, internal audit, and global security and asset protection functions, among others. Subject matter experts are also invited, as appropriate. The Cybersecurity Oversight Council meets at least quarterly and has responsibility for oversight and validation of the Company's cybersecurity strategic direction, risks, threats and priorities. The Cybersecurity Oversight Council acts in alignment with the Company's Risk Steering Committee, another cross-functional management committee, which provides strategic direction and oversight over the Company's ERM program. The CISO and his team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the Company's cyber incident response plan.


text: The Audit Committee of the Board of Directors is charged with oversight of cybersecurity matters and receives regular reports from the CISO and the CIO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In accordance with our cybersecurity incident response plan, the Audit Committee is promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Chair of the Audit Committee regularly briefs the full Board on these matters. In addition, the Board also periodically receives cybersecurity updates directly from management.


text: In an effort to detect and defend against cybersecurity threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, deep fakes, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.


text: Management's Role in Assessing and Managing Cybersecurity Risk; Processes for assessing, identifying and managing material risks from cybersecurity threats We have a systematic and thorough risk management process, which is designed to identify, assess, prioritize and mitigate the risks that could negatively impact achievement of our strategic and operating objectives. A key component of this process is our Enterprise Risk Management ("ERM") Committee, which is led by our Chairman, President and Chief Executive Officer, and includes our Chief Financial Officer, Chief Legal Officer, Chief Information Officer and other members of senior management. The ERM Committee monitors both current and emerging risks facing the Company and meets at least quarterly to review the prioritization of identified risks. The ERM Committee has identified cybersecurity as a critical risk facing the Company. Each of the most critical risks identified is assigned to a member of senior management who oversees the management, mitigation and presentation of the risk to the senior leadership team and throughout the year to our Board of Directors. The risks relating to information technology, including cybersecurity, are overseen by our Chief Information Officer. Our Chief Information Officer then assigns the risks within the Information Technology risk category to others on his team. The cybersecurity risk is managed and overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer. Cybersecurity as a risk is presented to the full ERM Committee annually or more frequently as needed.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: We have a dedicated information security organization, led by our CISO and overseen by our Chief Information Officer, which is responsible for assessing and managing material risks from cybersecurity threats. Our Chief Information Officer reports to our Group President, Growth and Strategy, a member of our senior leadership team who reports to our Chairman of the Board, President and Chief Executive Officer.


text: Our CISO has over 25 years of information technology experience, including leading data analytics, customer relationship management, architecture and application development teams. He has been leading our global information security program for almost five years. He is a Certified Information Systems Professional, a member of Google Cloud CISO Customer Advisory Board and New Jersey Infragard and completed the FBI CISO Academy. He joined the Company over 25 years ago and has extensive knowledge regarding our business processes and the associated information technology platforms utilized worldwide, enabling him to guide his organization to protect the Company's systems and information.


text: Our Chief Information Officer joined the Company over 25 years ago and has expertise across a wide array of information technology and systems, with experience leading a large array of different functions within the global information technology organization. He has led our information technology Operational Performance and Reliability Committee for the last eight years, which reviews and provides continuous improvement processes and technology across infrastructure, information security, architecture, application and end user performance. He has application development leadership experience across all functions, including the policies and controls that govern both application development and implementation of packaged software.


text: The Company's information security organization seeks to employ cybersecurity best practices, including implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. The information security organization also works in partnership with our Internal Audit function to identify cybersecurity risks and review cybersecurity-related internal controls with third parties as part of the overall internal controls process. The information security organization also gains valuable information to improve our threat and risk awareness capabilities as a member of an industry information sharing and analysis organization, which provides strategic and tactical information sharing channels. Additionally, employees are provided mandatory cybersecurity awareness training on an annual basis, which includes information about how to identify and report cybersecurity concerns and incidents. The information security organization also conducts phishing simulations and testing scenarios through tabletop exercises and assessment activities, to help ensure compliance with our cyber policies and procedures. We maintain a cybersecurity insurance policy and have retained relevant incident response services. Additionally, we maintain an offensive security team that works both independently and with third party cybersecurity professionals to conduct security assessments of our enterprise-wide cybersecurity practices, including penetration testing, and identify areas for continuous improvement within the information security program.


text: We maintain a Data Security Incident Response Plan (the "Plan"), which outlines the processes and procedures that we should follow to respond to, remediate and resolve a security incident involving a potential or actual compromise of our proprietary information and/or personal information. It also describes the structure, roles and responsibilities of personnel involved in responding to such incidents and provides a process for alerting senior management of such incidents. The Plan is reviewed on an annual basis and revised as necessary.


text: Our dedicated information security organization leverages various frameworks for managing cybersecurity risks, including the National Institute of Standards and Technology ("NIST") framework. The key pillars of the NIST framework are to (i) develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) develop and implement appropriate safeguards to ensure delivery of critical services; (iii) develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident; and (v) develop appropriate activities to action an incident.


text: We have a comprehensive third party cybersecurity risk review process, which prioritizes, monitors and assesses the risks associated with our third party service provider interactions. The third party service provider assessment framework follows industry standard practices and allows us to properly understand the risk associated with the services provided which are key to our company's daily operations.


text: For additional information regarding risks faced by the Company from cybersecurity threats, see Item 1A, "Risk Factors - A cybersecurity incident, data breach or a failure of key technology systems could adversely impact our business."


text: Board's Oversight of Cybersecurity Risks Our Board of Directors is focused on cybersecurity. Specific responsibility for cybersecurity oversight is delegated to the Audit Committee. The Board oversees our risk management process to ensure it is properly designed, well-functioning and consistent with our overall corporate strategy. Our Audit Committee oversees the ERM process and the implementation of appropriate risk monitoring and management systems, though all Board members attend Audit Committee meetings and participate in risk management discussions. The Audit Committee also oversees risks associated with cybersecurity, financial reporting and legal matters (including data privacy, competition law, litigation and ethics and compliance).


text: Our Board of Directors has adopted a written statement, known as the Independent Board Candidate Qualifications and made available on our website, outlining the qualities sought in our directors. This statement, which is refreshed periodically and was most recently updated in January 2023, is used by the Nominating, Governance and Corporate Responsibility Committee ("NGCR Committee") in evaluating individual director candidates. The NGCR Committee has identified experience with overseeing and managing risk management processes, including with respect to cybersecurity, as being important to creating an effective, well-rounded and diverse Board. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management process.


text: Our CISO provides a report to the Audit Committee on cybersecurity quarterly, or more frequently if circumstances warrant, including relevant cybersecurity incidents impacting the Company and on topics related to information security, data privacy and cyber risks and mitigation strategies. In addition, outside experts periodically present to the Board on cybersecurity.


text: Our CISO has over 25 years of information technology experience, including leading data analytics, customer relationship management, architecture and application development teams. He has been leading our global information security program for almost seven years. He is a Certified Information Systems Professional, a member of Google Cloud CISO Customer Advisory Board and New Jersey Infragard and completed the FBI CISO Academy. He joined the Company over 25 years ago and has extensive knowledge regarding our business processes and the associated information technology platforms utilized worldwide, enabling him to guide his organization to protect the Company's systems and information.


text: Our Chief Information Officer joined the Company over 25 years ago and has expertise across a wide array of information technology and systems, with experience leading a large array of different functions within the global information technology organization. He has led our information technology Operational Performance and Reliability Committee for the last nine years, which reviews and provides continuous improvement processes and technology across infrastructure, information security, architecture, application and end user performance. He has application development leadership experience across all functions, including the policies and controls that govern both application development and implementation of packaged software. He has a certification from Stanford University for Cybersecurity and Executive Strategy.


text: The Company's information security organization seeks to employ cybersecurity best practices, including implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. The information security organization also works in partnership with our Internal Audit function to identify cybersecurity risks and review cybersecurity-related internal controls with third parties as part of the overall internal controls process. The information security organization also gains valuable information to improve our threat and risk awareness capabilities as a member of an industry information sharing and analysis organization, which provides strategic and tactical information sharing channels. Additionally, employees are provided mandatory cybersecurity awareness training on an annual basis, which includes information about how to identify and report cybersecurity concerns and incidents. The information security organization also conducts phishing simulations and testing scenarios through tabletop exercises and assessment activities, to help ensure compliance with our cyber policies and procedures. We maintain a cybersecurity insurance policy and have retained relevant incident response services. Additionally, we maintain an offensive security team that works both independently and with third party cybersecurity professionals to conduct security assessments of our enterprise-wide cybersecurity practices, including penetration testing, and identify areas for continuous improvement within the information security program. The Company is a member of the Retail and Hospitality Information Sharing and Analysis Center, which provides additional intelligence associated with threats pertaining to our industry.


text: Board's Oversight of Cybersecurity Risks Our Board of Directors is focused on cybersecurity. Specific responsibility for cybersecurity oversight is delegated to the Audit Committee. The Board oversees our risk management process to ensure it is properly designed, well-functioning and consistent with our overall corporate strategy. Our Audit Committee oversees the ERM process and the implementation of appropriate risk monitoring and management systems, though all Board members attend Audit Committee meetings and participate in risk management discussions.


text: Our Board of Directors has adopted a written statement, known as the Independent Board Candidate Qualifications and made available on our website, outlining the qualities sought in our directors. This statement, which is refreshed periodically, is used by the Nominating, Governance and Corporate Responsibility Committee ("NGCR Committee") to evaluate individual director candidates. The NGCR Committee has identified experience with overseeing and managing risk management processes, including with respect to cybersecurity, as being important to creating an effective, well-rounded and diverse Board. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management process.


text: Our CISO reports to the Audit Committee on cybersecurity quarterly, or more frequently if circumstances warrant, including relevant cybersecurity incidents impacting the Company and on topics related to information security, data privacy and cyber risks and mitigation strategies. In addition, outside experts periodically present to the Board on cybersecurity.


text: Cybersecurity Program and Management Oversight The Company has established an Information and Cybersecurity program. The program is directed by the Company's Information Security Strategy Board ("ISSB"). The purpose of the ISSB is to (i) provide management direction and support for information security risk oversight for the Company's information security program and (ii) to engage Company leaders to promote information security risk awareness and sound information security risk management practices across the organization. The ISSB has been delegated authority from the Company's Enterprise Risk Management Committee ("ERM Committee") to advance and monitor the overall effectiveness of the Company's information security program and risk management activities. The ISSB also has the authority to direct effective and timely implementation of actions to address emerging information security risks and information security risk management deficiencies. The ISSB meets at least quarterly.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The ISSB is responsible for identifying, evaluating and monitoring information security risk across the Company. In order to fulfill this role, the ISSB engages in a variety of activities, including, but not limited to, the following: a. Review current status of the Company's overall information security program.


text: b. Review and monitor impacts, outcomes and remediation plans or mitigation activities related to internal and external security incidents, vulnerability scans or assessments. c. Review and monitor significant information security related projects and regulatory initiatives. d. Monitor metrics related to the Company's information security program.


text: e. Review and approve new, and modifications to existing, information security policies for which the ISSB has been designated approval authority by the ERM Committee. Existing information security policies are reviewed at least annually.


text: f. Review information security examination reports and other significant communications from regulatory agencies and the status of any outstanding information security related regulatory findings. g. Monitor and discuss emerging industry information security risk issues including applicable frameworks, rules and regulations.


text: h. Identify and analyze significant changes affecting information security risk management such as changes in the external environment, business model and leadership.


text: i. Review new, expanded or modified software and applications that process, transmit, or store sensitive information to ensure appropriate information security risk management is embedded in the development and implementation processes.


text: The ISSB is comprised of the following: a. Chief Information Security Officer – Chair g. Chief Risk Officer k. Director, Audit The Chief Information Security Officer ("CISO") is responsible for the Company's enterprise-wide Information and Cybersecurity Program. Responsibilities include the Information and Cybersecurity program, Security Architecture, Application Security, IT Risk Management, Operational Security, Security Consulting, Awareness and Training, Policies and Standards development, Incident Response and Information Security defense / mitigation strategy, strategic planning, and Vendor and Service Provider monitoring. The CISO has 25 years of experience with Information Security Program development, Application Security program development, IT Risk Management program development, Incident Response preparation, planning, and testing, Operational and Technical Security Architecture, and Creating Zero-Day defense strategies. The CISO is a Certified Information Systems Security Professional, is a member of the Information Systems Security Association and Infragard, and participates in local and national Security consortiums. CISO demonstrates expertise in Graham-Leach-Bliley Act, Health Insurance Portability and Accountability Act, Payment Card Industry, International Organization for Standardization 27001, National Institute of Standards and Technology, Open Worldwide Application Security Project, and other programs to provide strategic consulting across a variety of industry sectors.


text: The Company's Board of Directors (the "Board") is responsible for the oversight of all risk management activities, including cybersecurity risk. The Board has delegated that oversight responsibility to the Audit and Risk Committee. The Audit and Risk Committee has delegated the responsibility to advance and monitor the overall effectiveness of the Company's risk management activities, including cybersecurity risk, to the ERM Committee. The ERM Committee also has the authority to direct effective and timely implementation of actions to address emerging cybersecurity risks. The ISSB provides quarterly reports to the Operational Risk Management Committee and ERM Committee. Through reports received from the ERM Committee, the Audit and Risk Committee notifies the Board of Directors about new policies and policy changes, changes in standards applied, and key risk metrics to evaluate ongoing cybersecurity threats and security risk exposure (the "Governance Model"). In addition, the ISSB provides a full report on the Company's cybersecurity framework, risks, initiatives, and significant incidents to the Audit and Risk Committee or the Company's Board of Directors not less than annually.


text: Cybersecurity Risk Assessment Strategy, Policies and Standards The Company's cybersecurity program is primarily structured based upon national and international security protocols and frameworks. The Company has implemented a strategy to address threats to Company assets. The Company's Information Security program balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Company and customer information. The Company conducts benchmark reports of its Information Security program to assess its strength as measured against recommended industry security best practice entities.


text: The Company has a process to prioritize and manage security related projects. The ISSB provides oversight of program changes, security awareness updates, exposures from new exploits, and risks to information, data and systems. Policies and standards are regularly reviewed within the Governance Model and presented to the Board.


text: The Company utilizes a risk assessment approach to oversee and identify material risks from cyber threats, which includes information gathering, analysis, and prioritization of mitigation strategies. This approach was designed following security industry standard processes, models and guidelines. Risk assessments are a key component of the overall risk management process. The objectives of the risk assessment process are as follows: a. Provide assurance that management has implemented appropriate controls to mitigate risk. b. Identify applications, vendors, service providers, and/or business units that process, transmit, or store sensitive information. c. Comply with the various regulations addressing data security. d. Comply with the Company's information security policies and standards.


text: The scope of the risk assessment process includes but is not limited to the following asset types: a. Applications b. Business units h. Security infrastructure m. Cloud.


text: The Company conducts detailed due diligence (as described below), contract reviews and ongoing monitoring of high-risk third-party service providers. Third-party service providers hosting an application or providing a service that processes, analyzes, transmits, stores, or reports the Company's sensitive information must complete a control questionnaire. Vendors are subject to rigorous review of the vendor's internal control policies, procedures, data security and contingency capabilities. Ongoing monitoring is also performed annually on selected service providers. The program requires service providers on the ongoing monitoring list to provide the Company with a third-party security penetration assessment, and other artifacts based on the type of information processed, transmitted, or stored, annually.


text: The Company has also developed a comprehensive set of key risk metrics to evaluate ongoing cybersecurity threats and the security risk exposure. These metrics are used for threat trending, identifying attack vectors, and determining the effectiveness of controls. Key risk metrics are provided to management monthly and reported through the Governance Model to the Board.


text: Security event monitoring and detection The Company formally tracks and reports on major identified risks and vulnerabilities and the results of their analysis and evaluation. These details can then be used to track and monitor their successful management as part of the activity to deliver the required, anticipated results. Security risks are categorized by Practice or Vulnerability (exploitable). The information is reported in the monthly security metrics report along with quarterly reporting to the ISSB.


text: The Company actively monitors alerts and shared intelligence from a variety of industry-standard sources and takes appropriate actions when warranted. As new threats and vulnerabilities emerge that threaten its systems and data, the Company continues to evaluate and address these threats through a layered security approach.


text: The Company performs network and application penetration testing on external high-risk applications as well as network penetration testing across its production, test, and disaster recovery networks. The Company also performs tests on its operational defense and response to assess the ability to detect and respond to a threat actor. This allows the Company to test lateral movement, exploitation, data exfiltration, and evaluate its security posture around three primary security functions: detection, prevention, and response. The Company regularly participates in desktop exercises to help demonstrate incident preparedness and regulatory compliance. All testing results are reported to the Board quarterly through the Governance Model.


text: Incident materiality The Commerce Bank Cybersecurity Incident Investigation and Response Plan is a component of the Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response plan includes timely notification of a material cybersecurity incident to the Board of Directors and other members of senior management.


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers" within Risk Factors Item 1a.


text: Cybersecurity Program and Management Oversight The Company has established an Information and Cybersecurity program integrated into its risk management process. The program is directed by the Company's Information Security Strategy Board ("ISSB"). The purpose of the ISSB is to (i) provide management direction and support for information security risk oversight for the Company's information security program and (ii) to engage Company leaders to promote information security risk awareness and sound information security risk management practices across the organization. The ISSB has been delegated authority from the Company's Enterprise Risk Management Committee ("ERM Committee") to advance and monitor the overall effectiveness of the Company's information security program and risk management activities. The ISSB also has the authority to direct effective and timely implementation of actions to address emerging information security risks and information security risk management deficiencies. The ISSB meets at least quarterly.


text: Cybersecurity Risk Assessment Strategy, Policies and Standards The Company's cybersecurity program is primarily structured based upon national and international security protocols and frameworks. The Company has implemented a strategy to address threats to Company assets. The Company's Information Security program balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Company and customer information. The Company conducts benchmark assessments of its Information Security program to evaluate its strength as measured against recommended industry security best practice entities.


text: The Company engages cybersecurity assessors and consultants, including third party auditors, to perform annual penetration testing and risk assessments. These external parties provide validation of our processes and controls, ensuring they meet industry best practices and regulatory standards.


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers" within Risk Factors Item 1a.


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which would be used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted depending on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and utilize third parties to regularly review our response plans.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program within an ever-changing threat landscape and has designed ongoing cybersecurity management protocols that are embedded into our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team including our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter and are regularly exposed to phishing awareness campaigns that simulate real-world threats.


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and our vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established relevant privacy and data security standards. We also require our key vendors to complete security questionnaires and we conduct audits and vulnerability scans related to them. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.


text: While previous cybersecurity incidents and threats have not materially adversely affected our business strategy, results of operations or financial condition to date, any actual or perceived breach of our security could damage our reputation or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, "Information technology interruptions and breaches in data security could adversely impact our business, results of operations and financial condition" for more information.


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats CMC faces and other developments regarding our cybersecurity management protocols.


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. Both the CISO and the CIO have daily responsibility for cybersecurity risk management and establishing risk management practices, and are involved in the execution of the response plans described above when a possible cybersecurity incident occurs. We engage a third-party service provider on a bi-annual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.


text: The response plans referenced above define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT plays an important role in the detection, mitigation, and remediation of cybersecurity incidents and in informing relevant members of management and the audit committee on cybersecurity threats and events. Select members of the CIRT actively participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective, and thorough response to a potential cybersecurity incident.


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which is used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted based on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and engage third parties to regularly review our response plans.


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program and has designed ongoing cybersecurity management protocols that are embedded in our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team comprising our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter, and are regularly exposed to phishing awareness campaigns that simulate real-world threats.


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established, relevant privacy and data security standards. We also require our key vendors to complete security questionnaires, and we conduct audits and vulnerability scans of those vendors and their systems. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats and other developments in our cybersecurity management protocols.


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. The CISO and the CIO are responsible for daily cybersecurity risk management, establishing risk management practices and executing the response plans when potential cybersecurity incidents arise. We engage a third-party service provider on a biannual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.


text: The response plans define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT supports the detection, mitigation and remediation of cybersecurity incidents and informs relevant members of management and the audit committee about cybersecurity threats and events. Select CIRT members participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective and thorough response to potential cybersecurity incidents.


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Financial Officer. The CFO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The CFO has previously led IT/cyber strategy and programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. Pineapple Energy remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors," of this Annual Report on Form 10-K.


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Operating Officer. The COO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The COO has previously led IT programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. The Company remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.


text: Cybersecurity Risk Management Strategy and Program We identify and assess material risks from cybersecurity threats predominantly through the work of our Information Security ("InfoSec") team as part of our enterprise risk management ("ERM") process. Our ERM process is designed to identify and evaluate the full range of significant risks to Comtech. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our cybersecurity functions.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: The cybersecurity ERM process is administered by InfoSec with input from each business segment and function, continually monitors material cybersecurity risks facing Comtech, including cybersecurity threats and threats to our internal systems, our products, services and programs for customers, and our supply chain. Our CISO has extensive experience leading information technology for global organizations across communications, aerospace and defense, and works directly with our CEO, Chief Financial Officer, Executive Vice President ("EVP") of Systems and IT Controls, and other members of senior management to assess cybersecurity threats as part of our ERM process.


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: As a government contractor, we must comply with extensive cybersecurity regulations, including the DFARS related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. The policies and controls we have implemented to date reflect our adherence to these requirements and have been assessed by external organizations, including industry partners.


text: Enterprise Cybersecurity Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.


text: Cybersecurity for U.S. Government Authorized Systems Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual) and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Third Party Service Providers We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures and process execution, including incident detection, investigation, analysis and response, eradication and recovery.


text: Management of Third-Party Risks Our suppliers, subcontractors and third-party service providers are subject to cybersecurity obligations and controls as aligned with DFARS and U.S. Federal Acquisition Regulations ("FARS") requirements. We are making strides to ensure suppliers, subcontractors and third-party service providers are knowledgeable and aligned with DFARS and FARS requirements. We are also developing an enhanced program for our suppliers, subcontractors, and third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase to ensure their commitment to the mandates. Many of these contractors, suppliers or third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the DFARS and FARS, which obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of their implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.