text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. All companies utilizing technology are subject to threats and potential breaches of their cybersecurity programs. Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including customer and bank information. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our board of directors (the "Board"), through our Audit Committee, and our management, are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and procedures, and cyber security safeguards will be sufficient to protect against all possible threats and properly followed in every instance, or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CVB FINANCIAL CORP

ticker: CVBF

secItem: Item 1C


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and the Cybersecurity Assessment Tool (CAT2). Our cybersecurity program in particular focuses on the following key areas: Process


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: Incident Response, Recovery Planning and Disclosure Our Bank is subject to the Interagency Guidelines, as noted above, and our Company is subject to the SEC's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies adopted in July 2023. In accordance with these rules and regulations, we have sought to establish comprehensive incident response and recovery plans, and we continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our planned response to a cybersecurity incident. With respect to the potential disclosure of material cybersecurity incidents, we have designated our management Financial Review and Disclosure Committee as the proper forum to address such issues. Members of Financial Review and Disclosure Committee include the Chief Financial Officer ("CFO"), General Counsel, Chief Operating Officer ("COO"), Chief Risk Officer ("CRO"), and the Chief Information Security Officer ("CISO").


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, in the manner and to the extent required by our bank regulators and applicable regulations. Such third-party providers are subject to security risk assessments at the time of onboarding, and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by such third-party providers and other industry sources. In addition, we require our third-party providers to meet appropriate security requirements, controls and responsibilities and to investigate and report on security incidents that have impacted their operations, as appropriate.


text: Education and Awareness Our policies require each of our employees to participate in our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also conduct regular phishing email exercises and training to test employees of security practices to mitigate this threat.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, through its Audit Committee, oversees the management of our cybersecurity program led by our CISO. The Audit Committee receives regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, including material security risks and information security vulnerabilities. Specifically, the Audit Committee receives regular updates from our CISO on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, and any relevant internal and industry cybersecurity incidents.


text: Management's Responsibility The Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management's Corporate Information Security Committee (the "Security Committee"), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer ("CIO"), the CRO, and the COO. The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies.


text: Our CISO has more than 20 years of Information Technology and Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 24 years of Information Technology (IT) experience and 17 years of experience in the financial services industry. Our CRO has more than 32 years of experience in Banking and over 14 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with experience in loan servicing and documentation, cash management services, payment operations, information technology, vendor management, and treasury services.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks and would be notified between such regular updates regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our IT team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our executive director of IT. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the executive director of IT reports. Combined, members of our security committee and our internal IT team have more than 25 years of risk management experience, including with respect to IT and cybersecurity systems.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners, and employees toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, procedures, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks, and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, threat monitoring and tabletop exercises to inform our risk identification and assessment.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we also perform periodic risk assessments, which includes cybersecurity risks, monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; through our policies, practices, and/or contracts (as applicable), require employees and certain third parties to treat confidential information and data with care; periodically update our relevant policies and procedures; employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools and knowledge necessary to identify or address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices; conduct regular phishing email simulations to enhance awareness and responsiveness to possible threats; conduct annual cybersecurity training for our board of directors and senior management; run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; engage consultants to help us oversee and manage cybersecurity risks, processes, and incident response measures; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan outlines and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan further outlines the roles and responsibilities of various employees, managers, and senior leadership with respect to performing a materiality assessment and responding to cybersecurity events that are deemed material, as well as provides rapid escalation procedures after a cybersecurity incident. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and our board of directors, as appropriate.


text: Our cyber risk management program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The risk management program is focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. Regular assessments, including penetration tests, are performed. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking basis.


text: As part of the above processes, we regularly engage with consultants, and other third parties, review our cybersecurity program to help identify areas for continued focus, improvement, and compliance. We engage them, specifically, to assist us with cybersecurity risk assessments, external threat environment reviews, internal cybersecurity policy compliance and near-term incident response. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our key suppliers, which have access to consumer, patient, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We periodically perform diligence on certain third parties that have access to our systems, data, or facilities that house such systems or data; and we monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under the heading "Actual or attempted security incidents or breaches, loss of data, or other disruptions could expose us to material liability and materially and adversely affect our business, financial condition, and our reputation," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, these threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.


text: As of the date of this report, we do not believe that risks from any cybersecurity threats as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. We cannot guarantee that controls we will implement to mitigate this risk will eliminate it. See Item 1A of this Annual Report for discussion of this risk.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, any results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and/or other materials discussing current and emerging material cybersecurity threat risks and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments, and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Security Officer and/or General Counsel and Chief Privacy Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Our Chief Information Security Officer advises our Board on the specific vulnerabilities we identified and the controls we put in place to mitigate our risk.


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary. Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: In addition, our cybersecurity risk management and data strategy processes are further overseen by management team members. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Such individuals have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: Cybersecurity Risk Management and Strategy The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software and information assets, including client and other sensitive data. The program is comprised of policies, guidelines, and procedures. These policies, guidelines, and procedures are intended to align with regulatory guidance, the ISO Code of Practice for Information Security Controls, and common industry practices. Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The Company expects each associate to be responsible for the security and confidentiality of client information. We communicate this responsibility to associates upon hiring and regularly throughout their employment. We require each associate to complete training to protect the confidentiality of client information at the time of hire and during each year of employment. Associates must successfully pass a test to demonstrate understanding of these requirements and provide acknowledgement of their responsibilities.


text: Additionally, we regularly provide associates with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to a company's network, result in the theft of user credentials and, ultimately, place client or employee data, or other sensitive company data, and information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails. We regularly test associates to determine their susceptibility to phishing emails. We require susceptible associates to take additional training and provide regular reports to management. We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information.


text: The Company protects its network and information assets with industry-tested security products and processes. Our teams actively monitor company networks and systems to detect suspicious or malicious events. The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments. The Company also conducts vulnerability scans, and contracts with third-party vendors to perform penetration tests against the Company's network. In addition, the Company's Cyber Defense Center team monitors threat intelligence sources to anticipate and research evolving threats, investigates their potential impact to financial services companies, examines the Company's controls to detect and defend against those threats, and proactively adjusts the Company's defenses against those threats. The Company also engages expert cyber consultants, as necessary and appropriate.


text: Before engaging third-party service providers who may have access to the Company's, customer, employee or other sensitive data, or to the Company's systems, we perform due diligence in order to identify and evaluate their cyber risks, which includes self-attestation questionnaires (developed using Service Organization Controls (SOC) reports). This process is led by the Vendor Management team and includes participation of dedicated information security resources. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. After contract executions, third party service providers deemed critical by our vendor management office undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan ("Incident Response Plan"), which is administered by our Chief Information Security Officer ("CISO") in close collaboration with our Director of Enterprise IT Risk. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents. The Incident Response Plan is intended to proceed on parallel paths in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business, communications, and risk personnel. Our incident response team annually performs exercises to simulate responses to cybersecurity events.


text: The Incident Response Plan includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, and our Board Risk Committee.


text: Impacts of Cybersecurity Incidents To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee. The Board also periodically designates directors as its cybersecurity contact points. Our Chief Operating Officer facilitates the involvement of these designated directors in oversight of potentially significant cybersecurity incidents. The current directors designated as cybersecurity contacts are Chairman Jerry Levens, Board Risk Committee Chair Frank Bertucci, and Suzette Kent.


text: The Risk Committee oversees the management process associated with cybersecurity risk. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings. The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. The Board Risk Committee provides reports to the full Board on the Company's information security program on an annual basis.


text: The Company's CISO directs our information security program and the Director of Enterprise IT Risk directs our information technology risk management. Led by our CISO and Director of Enterprise IT Risk, a team of dedicated security professionals examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment and provides immediate responses to threats.


text: The CISO regularly attends Board Risk Committee meetings and sits in executive session with the Committee members at least annually to update committee members on material cybersecurity and other information security developments and risks. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: The IT Risk Governance Subcommittee, a management level subcommittee of our Operations Committee, also addresses information security and is responsible for overseeing the protection of the integrity, security, safety and resiliency of corporate information systems and assets. The IT Risk Governance Committee meets quarterly to review the development of the program and provide recommendations. The subcommittee provides regular reports to the Operations Committee and, ultimately, the Board Risk Committee through the CISO. Together, our CISO and Director of Enterprise IT Risk co-lead the company's IT Risk Governance Committee.


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is a member of the Company's Corporate Operations group and reports to our Chief Information Officer, who in turn reports to our Chief Operating Officer. Our CISO has cybersecurity experience spanning more than two decades. Prior experience includes senior security roles in large government agencies and Fortune 200 companies. He has spoken at area colleges and various industry events about information security. He holds a degree in electrical engineering, is a graduate of banking school, and maintains several industry certifications.


text: Our Director of Enterprise IT Risk is responsible for the Company's information technology governance, risk, and compliance program. In this role, the Director of Enterprise IT Risk provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Director of Enterprise IT Risk is a member of the Company's Corporate Risk Management Group and reports to our Chief Risk Officer, who in turn reports to our CEO. Our Director of Enterprise IT Risk has over two decades of business continuity, crisis management and risk experience in the financial services industry and maintains related industry certifications.


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our information technology systems. Our Chief Information Security Officer has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our Board of Directors has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST") and contractual, industry and regulatory best practices and requirements.


text: Our written Cybersecurity Incident Response Program coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to prepare for, assess severity of, escalate information about, contain, eradicate, and recover from the incident, as well as to conduct post-incident activities, including reporting and conducting root cause analysis and remediation activities. Our incident response policies and the cybersecurity posture are subject to annual testing to evaluate our adherence to policies and compliance requirements. Policies and practices are reviewed periodically to improve processes and practice. We carry cybersecurity insurance to provide a level of financial protection should a covered incident occur.


text: Our cybersecurity and privacy program includes mandatory annual training for all employees and contractors reinforced by targeted phishing tests. The annual training includes training on how to identify potential cybersecurity and privacy risks and protect our resources and information. Additionally, we provide additional specialized security training for employees in roles relating to product development or information technology.


text: While we believe our cybersecurity and privacy program to be appropriately designed in light of the risks we have identified, we have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. See "Risk Factors—Our solutions or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations."


text: Risk management and strategy Cytokinetics recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our critical data.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our CISO, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, a vulnerability management policy, disaster recovery and business continuity plans and a vendor risk management program; conducting employee training, systems monitoring and penetration testing; implementing security standards, network security controls, access controls and physical security; encrypting and segregating data; though asset management, tracking and disposal; and maintaining cybersecurity insurance.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a culture of cybersecurity risk management. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes. Our risk management team works closely with our IT department and cybersecurity team to evaluate and address cybersecurity risks connected with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Cytokinetics engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Oversee Third Party Risk Because we are aware of the potentially material risks from cybersecurity threats associated with third-party service providers, Cytokinetics implements processes to oversee and manage these risks. Depending on the nature of the services provided and the identity of the service provider, we may conduct security assessments of the provider before engagement and may monitor their compliance with our cybersecurity policies after engagement. The monitoring includes periodic assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security specialists. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the discussion under the headings "Our internal computer systems, or those of our CROs, CMOs, supply chain partners, collaboration partners or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug development programs" and "Significant disruptions of information technology systems or breaches of data security could adversely affect our business".


text: Cytokinetics' Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms designed to ensure effective governance in managing material risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise, including, risk management, technology, and finance. The Audit Committee reports to the Board of Directors periodically regarding cybersecurity topics presented to the Audit Committee, and all materials made available to the Audit Committee are available to rest of the Board of Directors.


text: Management's Role Managing Risk The CISO, the Vice President, Information Technology ("VP of IT"), the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, CISO, VP of IT, CEO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with the CISO, Mr. Eric Brown. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Mr. Brown reports to the VP of IT, Mr. Daniel Casper. With over 20 years of experience in IT leadership roles in biopharma and industry services, Mr. Casper brings expertise in leading the effective business use of technology solutions and services to our industry. Our VP of IT has overall responsibility for the Company's IT department and operations, including oversight over the CISO and cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.


text: Monitor Cybersecurity Incidents The CISO is responsible for informing himself from appropriate sources about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs the VP of IT, the CFO, the CEO, and the General Counsel or Head of Legal of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of the CEO, the CFO and the General Counsel or Head of Legal to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity risk is integrated into Primerica's enterprise risk management system. Primerica's enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

companyName: Primerica, Inc.

ticker: PRI


text: Primerica institutes a three-lines-of-defense model for information security risk assurance, in which management owns the risk, our enterprise risk management team assesses the risk and oversees compliance with internal guidelines and policies, and our internal audit team reviews the effectiveness of the first two lines of defense. Management works with external assessors, consultants, auditors, and other third parties from time to time in conducting maturity and technical assessments.


text: Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company's policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy. e-TeleQuote operates under certain of its own separate policies and procedures related to physical and information security. These policies and procedures are similar in nature to the ones discussed above.


text: We have an incident response plan designed to help us monitor the prevention, detection, mitigation, and remediation of information security incidents. The incident response plan documents the roles and responsibilities of Primerica personnel in responding to information security incidents, including the process by which the Chief Information Security Officer, the Chief Information Officer, senior management, and the Board is informed about such incidents.


text: The Chief Information Security Officer leads the Company's Incident Advisory Committee ("IAC"), which is notified in the event of high or medium severity incidents. The IAC includes representatives from information technology, legal, and often the impacted business unit. The Incident Response Team ("IRT") consists of the IAC and a larger group of managers that is typically notified of more significant incidents. The IRT reports findings to management and the Board as necessary. Each IRT member has specific responsibilities related to his or her function at the Company. On a semi-annual basis, the IRT and management undertake facilitator-led trainings and simulations of information security incidents.


text: Previous cybersecurity incidents have not materially affected the Company. For a discussion of risks to the Company related to cybersecurity threats, see "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity", which is incorporated herein by reference.


text: The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company's incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2023, the Board participated in a facilitator-led training and simulation of an information security incident.


text: Primerica's senior executive leadership is actively involved in managing material risks from cybersecurity threats. Primerica's cybersecurity operations risk steering group is chaired by the Chief Operating Officer and holds quarterly meetings. It includes key executives from the Company's technology, security, privacy, and legal teams, coordinates corporate security initiatives and provides high-level guidance on technology-and security-related issues. The Chief Information Security Officer has responsibility for assessing and managing the Company's material risks from cybersecurity threats. The Chief Information Security Officer has served in various roles in information technology and information security for 35 years, including serving as the Company's Chief Information Security Officer for over 23 years.


text: Our Board recognizes the importance of understanding, evaluating and managing risk and its impact on the financial health of our company and has the ultimate oversight responsibility for the risk management process. The Board's role in risk oversight is consistent with our leadership structure, with our CEO and other members of senior management having responsibility for assessing and managing our risk exposure, and the Board and its committees providing oversight in connection with those efforts. The Board exercises these responsibilities regularly as part of its meetings and also through the Board's standing committees, each of which examines various components of enterprise risk as part of their responsibilities.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: Throughout the year, the Board and the relevant Board committees receive updates from management with respect to various enterprise risk management issues and dedicate a portion of their meetings to reviewing and discussing specific risk topics in greater detail, including risks related to cybersecurity and climate change, to, among other things, assist in identifying the principal risks facing our company, identifying and evaluating policies and practices that promote a culture designed to appropriately balance risk and reward, and evaluating risk management practices.


text: Cybersecurity is a critical part of our risk management approach, and we maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats, including cybersecurity threats associated with our use of third-party service providers. To address cybersecurity threats more effectively, we leverage a multi-layered approach. Our CEO and other members of senior management have responsibility for assessing and managing our cybersecurity risk exposure, and we have a dedicated Chief Information Officer (or CIO), who is responsible for oversight of our overall cybersecurity program, which includes protecting the industrial control systems, data, corporate infrastructure (e.g. databases, servers and network equipment), end user devices (e.g. desktops, laptops, and mobile devices) and internal websites. Our CIO reports directly to our CFO.


text: We also have a dedicated Director of Information Security (or DIS), who reports to our CIO and chairs our Cybersecurity Committee, comprised of internal Information Technology (or IT) IT experts who continuously review risks and vulnerabilities and execute cybersecurity initiatives. Our CIO, DIS and other members of our IT team have extensive experience in managing company-wide information security programs. Our CIO has over 20 years of experience in IT management and a Bachelor of Science in Advance Technical Studies/Computer Information Processing. Our DIS has over 25 years of experience in IT/OT Security, including as a cybersecurity consultant, Supervisory Control and Data Acquisition (SCADA) Network and Security Architect and Security Analyst/Security Engineer.


text: We have also engaged a third party service provider to monitor our IT infrastructure and information systems for security threats, escalate any threat to our IT team, and assist us in responding to threats, vulnerabilities and risks. Our cyber risk management program is aligned with the standards, guidelines and best practices of the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).


text: Upon the detection of any cybersecurity incident, our CIO and DIS provide reports to our CEO and other members of senior management, including with respect to the monitoring, investigation, mitigation and remediation of the incident. Our Board and Audit Committee oversee our cybersecurity management and receive regular updates from senior management, including our CIO, on matters such as major cyber risk areas, cybersecurity monitoring and prevention technologies and practices and occurrence, mitigation and remediation of cybersecurity incidents, if any. We also periodically engage third parties to perform cybersecurity assessments to detect vulnerabilities, such as ransomware or data loss, and to provide cybersecurity incident response training.


text: We rely on our IT infrastructure and information systems to interact with our customers and vendors, operate our drilling rigs, and bill, collect and make payments. Our IT infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies. If our systems, or any of our customers' or vendors' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could subject us to significant liabilities and could have a material adverse effect on our operations, financial condition, business or reputation.


text: Like many large, global companies, CommScope relies heavily on digital technology to conduct operations and engage with our customers and business partners. As our engagements become more complex and interdependent, threats from security incidents like ransomware and data breaches increase. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our data and the data customers and other stakeholders entrust to us a top priority. Our Board of Directors (Board), through our Audit Committee, and our management team are actively involved in the oversight of our Enterprise Risk Management (ERM) program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. We have made investments in resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe that risks from prior cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that any such incidents will not materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks associated with cybersecurity incidents, see Item 1A. "Risk Factors."

companyName: Vistance Networks, Inc.

ticker: VISN


text: CommScope's commitment to cybersecurity begins in the boardroom. The Audit Committee is responsible for oversight of cybersecurity and is actively engaged with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) at least quarterly, in addition to ad-hoc discussions and our periodic cyber crisis management tabletop exercises. Our CIO and CISO also present on cybersecurity to our full Board at least annually. The commitment extends through our executive leadership team (ELT), who engage continually to review our cybersecurity strategy, planning and execution.


text: At CommScope, cybersecurity risk is part of our cross-functional Enterprise Risk Management (ERM) program because of the potential for negative impacts of an incident across our business. At least annually we conduct a cybersecurity risk assessment, bringing together threat intelligence, internal assessment of our control posture and third-party opinions. The risk assessment informs our Board and management team and drives the next year's security strategy and initiatives.


text: CommScope has implemented a cybersecurity program that is dedicated to protecting our business processes, technology assets and sensitive information entrusted to us by our customers, suppliers, employees and other stakeholders. Drawing on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) 18 Critical Security Controls, our security program seeks to identify high-value enterprise assets and business processes and manage the cybersecurity threats facing them with layered controls. We practice a "Defense in Depth" methodology, meaning that valuable assets or business processes are generally protected with more than one layered control.


text: Our cybersecurity program is led by our CIO and our CISO. Our CIO has served in various roles in information technology and information security for over twenty years. Our CISO has over twenty years of technology and security experience and has spent more than fifteen years leading cybersecurity functions. He is also a Certified Information Systems Security Professional (CISSP).


text: Our CISO leads an in-house information security team responsible for cybersecurity risk and threat evaluation; the writing of relevant policies, control standards, and technical requirements; and the oversight and operation of security controls. The Security Operations team monitors for potential incidents via a global team operating 24 x 7 x 365 in a "follow the sun" model. We also engage outside experts where a third-party opinion or subject matter expertise provides specific value, such as with penetration testing. We use industry-leading security tools, regularly update our technology roadmaps, conduct tabletop exercises and mandate cybersecurity awareness and training for all employees.


text: We not only focus on cybersecurity threats directly facing CommScope but also those that might affect us through one of the many third parties we do business with, including suppliers and customers. Our procurement and security teams have a shared process to review the cybersecurity risk of our suppliers, performing an assessment during onboarding, requiring them to sign up for contractual security requirements, emplacing security controls and investigating third-party incidents as appropriate.


text: In the event of a significant cybersecurity incident, we have a detailed Cybersecurity Incident Response Plan (CIRP) in place for informing key stakeholders, ensuring events are properly escalated and for contacting authorities. There are many ways that CommScope might initially learn of a cybersecurity incident, and these potential incidents are escalated, according to decision criteria, to a core team of internal stakeholders comprised of leaders from our information security, legal, business and finance organizations. The core team directs the initial fact-finding and response efforts, and based on their qualitative and quantitative review, may escalate the incident to CommScope's ELT. The ELT then makes the decision on escalation to the Audit Committee or Board based on the team's assessment of materiality. Our incident response plan is regularly validated and assessed to consider the types of decisions that would need to be made in the event of a cybersecurity incident.


text: Assessing, Identifying and Managing Cybersecurity Risks — We strive to align our cybersecurity operating model with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to enhance our ability to protect, detect, respond, and recover from potential cybersecurity threats. Our cybersecurity team actively works to assess, identify and manage risks in our information systems in order to protect the confidentiality, integrity and availability of our digital infrastructure. The cybersecurity team meets regularly to evaluate potential threats, discuss best practices and identify new solutions to help mitigate cyber risks.

companyName: TALOS ENERGY INC.

ticker: TALO


text: We engage third-party service providers to conduct evaluations of our cybersecurity controls through penetration testing, independent audits and consulting on best practices to address existing and new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls. To further enhance the capabilities of our internal systems, we utilize third-party vendors to provide extended coverage of our information technology and operational technology environments. We also share and receive threat intelligence with companies in the energy sector, government agencies, information sharing and analysis centers and cybersecurity associations in order to monitor and address developments in the cybersecurity environment.


text: To serve as an additional protection from outside threats, we also seek to prepare our employees and contractors about cybersecurity risks through training, simulated phishing exercises and awareness campaigns. We have implemented software and processes to help identify and evaluate risks from cybersecurity threats associated with third-party service vendors. In the event of a cybersecurity incident deemed to have a moderate or higher business impact, we have an incident response plan to notify senior leadership and to address how to contain the incident, mitigate the impact, and restore normal operations efficiently.


text: Cybersecurity Risk Assessment — We have integrated cybersecurity risk management into our broader Enterprise Risk Management ("ERM") framework to promote a company-wide culture of cybersecurity risk management. Our ERM framework is designed to identify and prioritize company-wide risks, including cybersecurity threats, and integrate mitigation measures into our business, operational and capital structure planning activities. The purpose of the ERM framework is to enable the Board and executive leadership to (1) align risk management with strategic objectives, (2) identify risks, including cybersecurity risks, throughout the organization, (3) assess and prioritize risks that could impact the Company's operational and strategic objectives, (4) develop and monitor risk mitigation initiatives, and (5) report and assess material risks, mitigation strategies and progress to the Board and/or its applicable committees. Cybersecurity risk is reviewed by a cross-functional, management-level ERM Steering Committee as part of the Company's overall enterprise risk management program.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats — The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Audit Committee has been delegated responsibility by the Board for overseeing the Company's overall enterprise risk management program, including cybersecurity risk. The Audit Committee receives reports at least quarterly from the Director of Information Technology regarding cybersecurity matters, which may include, among other things, the results of cybersecurity audits, cybersecurity maturity assessments, other information technology matters, risk mitigation strategies, data protection and progress on initiatives. The Audit Committee Chair is responsible for reporting key cybersecurity issues regarding current and potential material cybersecurity threats and our risk mitigation response strategies to the Board. To further inform our Board and management on emerging cybersecurity issues, we periodically engage third-party cybersecurity experts to report to the Audit Committee, other directors, and management, as applicable, on topics that may include, among other things, the latest cybersecurity trends, new technologies, evolving threats in the marketplace, proposed initiatives, legislation, and reporting standards.


text: Management's Role in Assessing and Managing Cybersecurity Threats — Our information technology team is responsible for assessing, identifying and managing cybersecurity risks. Top cybersecurity risks are also integrated into our overall ERM framework and overseen at the management level by the ERM Steering Committee. Our Director of Information Technology, who reports directly to the Chief Financial Officer ("CFO") and Senior Vice President and is a member of the ERM Steering Committee, is responsible for our efforts to comply with applicable cybersecurity standards, establish cybersecurity protocols and protect the integrity, confidentiality and availability of our information technology infrastructure. Technology and cybersecurity policy decisions are made by our Director of Information Technology in consultation with our CFO and Senior Vice President. In addition, our Director of Information Technology has a direct line of communication with our President and CEO and Executive Vice President and General Counsel as needed. Our Director of Information Technology has over 20 years of experience in cybersecurity, holds a Master of Science in Cybersecurity from the University of Houston and is a Certified Information Systems Security Professional and a Boardroom Certified Qualified Technology Expert.


text: Impact of Risks from Cybersecurity Threats — As of the date of this Annual Report, we are not aware of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, although the Company regularly experiences cybersecurity incidents that are not deemed material to our operations. Examples of cybersecurity threats we face include incidents common to most companies in the energy industry, such as phishing, business email compromise, ransomware and denial-of-service, as well as attacks from more advanced sources, including nation state actors, that target companies in the energy industry. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely disrupt our operations, including our drilling operations, and affect our performance and results of operations. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Please see Part I, Item 1A. "Risk Factors — Risks Related to our Business and the Oil and Natural Gas Industry — Our business could be negatively affected by security threats, including cybersecurity threats, terrorist attacks and other disruptions."


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: Overview of Cybersecurity Risk Management and Strategy Based on our business model, we rely on the outsourcing of certain key business functions, including laboratory work, clinical research, and the manufacturing and distribution of our product. We utilize the vetted processes and procedures of these partners and ensure proper cybersecurity and risk mitigation strategies are in place and functioning, which is accessed through our Vendor Risk Assessment process prior to engaging with our partners. Our cybersecurity risk identification, assessment and management response process is a critical part of our overall enterprise risk management, or ERM, program. Within our ERM framework, we adhere to our Global Information Technology Policy, or IT Policy, among a host of other policies and procedures aimed at providing guidelines and standards to ensure the security, integrity, reliability and recoverability of our systems and infrastructure.


text: We employ and manage various third party partnerships to help protect us from cybersecurity threats. These organizations provide services such as penetration testing, security assessments, as well as twenty-four hours per day monitoring, alerting and response, including incident responses, all of which adhere to our overall ERM framework. Our partners evaluate and rank our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats. Our digital infrastructure undergoes both internal and external audits as part of our Sarbanes-Oxley audit process and is designed to address the requirements of applicable information security standards and an evolving cyber landscape.


text: Board Oversight of Risks from Cybersecurity Threats Our Board of Directors has delegated to the Audit Committee oversight of risks from cybersecurity threats. The management team provides quarterly reports to the Audit Committee which cover cybersecurity and other information technology-related risks, based on our ERM framework. These quarterly updates keep the Audit Committee apprised of our ongoing cybersecurity enhancements and any emerging global threats. The Audit Committee keeps the remaining Board of Directors apprised of material risks from cybersecurity threats.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Technology and Security team is responsible for the management, maintenance, monitoring and response of our critical internal digital assets. This team is led by our Senior Director of Global Information Technology and Security, who has 25 years of cyber and Enterprise IT management experience. This position monitors current cyber risk trends, engages with 3rd party cyber security experts, and meets with the Infrastructure and Security team regularly to stay apprised of internal cyber risks.


text: Our internal cybersecurity testing and reporting processes allow us to rank our overall risk on a periodic basis to ensure we identify and respond to internal risk trends. We follow escalation procedures to ensure communication of cyber-related events. The Board and management have made cybersecurity education and training a part of our overall corporate objectives, setting the tone for the organization about the importance of cybersecurity.


text: As of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For information regarding cybersecurity risks, see our discussion above in Item 1A. Risk Factors - Risks Related to Our Business - Our internal computer systems, or those of our third party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our commercial, research and development and other programs.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Capital Corp.

ticker: GECC


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. This program is based on recognized industry standards and is supported by both management and our Board. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use recognized industry standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by GECM's Chief Operating Officer, IT Specialist and other members of Company management (together, "Great Elm IT Management") and third third-party consultants. In order to oversee and identify risks from cybersecurity threats associated with its use of third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs annual reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.


text: GECM also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by Great Elm IT Management. The members of the IT Management team collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. Great Elm IT Management is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by Great Elm IT Management, with support from their third-party consultants. Great Elm IT Management alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing its severity and determining potential responses, as well as communicating with business leaders and senior management, as appropriate.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program, which is supported by third parties, is designed to allow us to identify, assess, and manage cybersecurity risks. Our external partners include professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and security testing firms. We have also begun an assessment process, using an external partner, to assess cybersecurity risks across our business that is informed by the Center for Internet Security Controls and have recently invested in a full-time role dedicated to assessing, developing, and maintaining our IT/Cybersecurity infrastructure. Our Senior Director IT has years of experience leading cybersecurity teams. We also provide cybersecurity trainings to our employees during onboarding and are formalizing an ongoing information security training program for active employees and relevant consultants to address matters such as phishing, email security, and training on data privacy.

companyName: Akero Therapeutics, Inc.


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery to third parties, corporate productivity services, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct cybersecurity reviews as part of our quality assessment processes.


text: The Company reports on its information security program, including the results of periodic testing, to the Audit Committee of the Board of Directors. Our Board's Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reviews management presentations concerning cybersecurity-related issues, including information security, technology risks, policies, and risk mitigation programs. The Audit Committee reports matters to the Board of Directors as needed. Our Chief Operating Officer, with the support of our Senior Director IT and third-party consultants, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Operating Officer also works closely with other management positions and external legal counsel to ensure that the Company understands its cybersecurity risk management responsibilities.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: The oil and gas industry, including the mineral and royalty space, has become increasingly dependent on digital technologies to conduct certain activities. Sitio depends on digital technologies to perform many of its services and to process and record financial and operating data. Sitio therefore recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We seek to assess, identify and manage cybersecurity risks through the processes described below.

companyName: Sitio Royalties Corp.


text: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. We also engage third-party consultants to conduct regular assessments of our cybersecurity safeguards. Our internal Information Technology ("IT") team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on third-party service providers for alerts regarding suspicious activity.


text: Incident Identification and Response We have implemented a monitoring and detection system to help identify cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Cybersecurity Training and Awareness All employees are required to receive annual cybersecurity awareness training.


text: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.


text: Encryption and Data Protection Encryption methods are used to protect sensitive data. This includes the encryption of employee laptops, customer data, financial information, and other confidential data.


text: We engage third-party consultants in connection with our cybersecurity program. For example, we have engaged an independent consultant to not only perform certain testing but to also provide remediation recommendations as applicable regarding our information security program and information technology strategic plan.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, the Company has not been subject to any material cybersecurity incidents. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company's IT function focuses on current and emerging cybersecurity matters. The Company's IT department is led by the Director of IT, who reports to the Company's Executive Vice President, Operations, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, the Director of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. The Director of IT has served at Sitio since 2022 and has over 18 years of experience in managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs at Sitio and similar companies.


text: Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and IT risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. The Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and IT risks. As appropriate, the Board or Audit Committee reviews and discusses with management the Company's procedures and practices as well as any potential identified incidents with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Executive Vice President, Operations is responsible for keeping the Board of Directors apprised of cybersecurity incidents and the Board is charged with determining the materiality of such incident.


text: Cybersecurity Risk Management and Strategy Like all companies with an internet presence, we are regularly subject to cyberattacks and other cyber incidents, and, therefore, cybersecurity is an important element of our ongoing information technology operations. We devote significant resources to protecting and enhancing the security of our computer systems, business information, software, networks and other technology assets, by applying our cybersecurity risk management processes, which consider physical, procedural and technical safeguards. We have a multi-faceted program for assessing, identifying and managing cybersecurity risks, that is designed to help protect our information assets and operations from internal and external cyber threats by: • organizing our cybersecurity efforts based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework by applying the framework's rubric of Identify, Protect, Detect, Respond, and Recover; • seeking to understand, manage and mitigate risk while ensuring business resiliency and protecting business, employee and patient information from unauthorized access or attack; • identifying critical business information, the lifecycles of that information, and the systems where this information is stored, distributed, processed, and eventually destroyed. For example, by managing important external parties and their operations, analyzing their cybersecurity risk to our business operations, and reviewing the residual risk with business leaders to accept and manage each external party appropriately; • protecting and securing our systems from attack with secure configuration standards and protective cybersecurity tools; • detecting potential attacks through appropriate tools, including cybersecurity-related data collection and analysis to help identify potential attacks; • responding to alerts from those tools with processes to verify whether there is a real incident and the severity of that incident using appropriate resources and team members, including establishing and exercising a Cybersecurity Incident Response Plan ("IRP") based on recognized industry practices, including NIST guidance; and • establishing and exercising processes and procedures to recover from cybersecurity incidents.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Our IRP contains tools, and guidance related to cybersecurity events and is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents as well as comply with applicable legal obligations. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We regularly engage external parties, inclusive of but not limited to, service vendors, consultants, independent privacy assessors, peer companies, industry groups, and governance experts to enhance our understanding and application of oversight of the cybersecurity landscape. For example, we provide an annual assessment of our cybersecurity program, completed by our third-party Chief Information Security Officer ("CISO"), to our Audit Committee for review and feedback. These external parties provide an industry perspective on appropriate risk management and investment in our cybersecurity efforts that is reviewed and approved by company management and the Board of Directors.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.