text: A dedicated cybersecurity team lead by a cybersecurity manager oversees the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's corporate security senior manager. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.


text: The cybersecurity team monitors and reviews threat intelligence feeds from various sources, including security vendors and U.S. federal and state agencies, to determine potential risks to the companies' information and control systems. Additionally, the team utilizes a defense-in-depth approach to cybersecurity that provides layers of defenses and monitoring/alerting to which the team responds. The team also monitors the companies' third-party service providers for risks related to the confidentiality, availability, and integrity of the companies' data and services hosted through those third parties.

companyName: IDACORP INC

ticker: IDA

secItem: Item 1C


text: The companies have an established cybersecurity incident response plan to provide structure and guidance when responding to cybersecurity incidents. In appropriate cases, an incident response team is activated to lead the companies' response. The team is composed of individuals from the cybersecurity team and other departments within the companies with relevant expertise, as well as third-party contractors and vendors.


text: As of the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: A dedicated cybersecurity team lead by a cybersecurity manager and director of security oversee the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's director of security. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.


text: Utilities are the operators of critical infrastructure and maintain sensitive information, and as such the industry has been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems and confidential information to disrupt operations or for monetary gain. Idaho Power, like other entities in the utility industry, is experiencing an increase in the frequency and sophistication of these attempts. For the year ended December 31, 2024, and the subsequent period to the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that any such threat or incident will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: Cybersecurity Risk Management and Strategy As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Information Security Officer ("CISO") and our Chief Customer and Technology Officer ("CCTO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We also are a member of an industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: We assess Chipotle's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to periodically perform internal and external penetration testing of Chipotle's information security environment and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform Chipotle during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), Chipotle has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Chipotle (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes are led by our CISO and our CCTO. These individuals have collectively over 50 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews with and discusses cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape with our CISO and CCTO. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by the enterprise risk management team.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.


text: Cognizant's cyber risk management program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.


text: We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In 2020, we experienced a previously-disclosed cybersecurity incident that resulted in unauthorized access to certain data and caused significant disruptions to our business operations. In response, we engaged leading outside forensics and cybersecurity experts, launched a comprehensive containment and remediation effort and forensic investigation, restored the security of our internal systems and networks and adopted various enhancements to the security of our systems and networks.


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee previously utilized an IT Cybersecurity Subcommittee, comprised of members of the Audit Committee, to assist in carrying out a portion of these responsibilities. In December 2023, the Audit Committee transitioned away from use of the subcommittee structure. At all times, the full Audit Committee has maintained and continues to maintain oversight responsibility for cybersecurity risk management.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement, and govern security policies, standards, and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework established by the enterprise risk management team.


text: Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including ISO/IEC 27001, TISAX and NIST. The program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors".


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement and govern security policies, standards and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.


text: Risk Management and Strategy The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology (NIST) framework, organizing cybersecurity risks into five categories: identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer and security team, led by the SVP of Information Technology and Security, (collectively, the "Cumulus Security Team") monitor cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery plans are documented for key systems and would be followed in the event a security incident occurs.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: The Company's cybersecurity risk management program includes ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes various incident event management tools to monitor unauthorized account access, data exfilitration and server and network security. Multi-factor authentication and complex password requirements are enabled on all key systems and privileged account holders have separate administrative accounts. The Company engages consultants from time to time with expertise in network vulnerabilities to perform periodic network penetration testing.


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".


text: Our Board of Directors (our "Board") is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.


text: Our Chief Technology Officer manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The Cumulus Security Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.


text: Risk Management and Strategy The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology ("NIST") framework, organizing cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer, together with our SVP of Information Technology and Security, are responsible for leading, managing, and monitoring the Company's cybersecurity risk with the assistance of our security team (collectively, the "Cumulus Security Team") who monitors cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution pursuant to the Company's internal incident response plan. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery and incident response plans are documented for key systems and would be followed in the event a cybersecurity incident occurs.


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers, who may be system vendors or data processors. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions, failures or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".


text: Our Board is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.


text: Our Chief Technology Officer, together with our SVP of Information Technology and Security, leads, manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The SVP of Information Technology and Security has over 30 years of experience in the IT and information security field and directs our Cumulus Security Team, which is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2023, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.

companyName: MOODYS CORP /DE/

ticker: MCO


text: The Cyber Committee, chaired by the CISO, and whose members include the CTSO and CAO, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber


text: MOODY'S 2023 10-K 35 Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company's Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.


text: The CISO has extensive cybersecurity knowledge and skills, gained from over 20 years' experience working in regulated industries. The CISO holds a number of cybersecurity related certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. In addition to the CISO, the CTSO has been a close partner and advocate for cybersecurity at the Company, and is consulted or informed on all decisions or risks that affect the Company's technology systems and/or implicate cybersecurity. The CAO is responsible for overseeing the cybersecurity team at the executive leadership level.


text: Board of Directors and Audit Committee The Board provides oversight of management's efforts to assess and manage cybersecurity risks and respond to cybersecurity incidents and threats. In addition, the Audit Committee of the Board of Directors regularly receives reports from management regarding the Company's financial and compliance risks, including, but not limited to, risks relating to internal controls and cybersecurity risks.


text: The Board receives regular updates from the CISO, CTSO, and CAO regarding matters related to technology and cybersecurity. The Company has protocols, as discussed below, by which certain cybersecurity concerns, incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board.


text: Risk Management and Strategy The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee and the Audit Committee.


text: The Company's cybersecurity environment is also subject to routine vulnerability assessment processes. Internal and external teams, including the Cyber Committee, conduct activities such as penetration testing, red teaming, tabletop exercises and phishing drills. Results are measured and assessed for possible improvements. In addition to these ongoing efforts, the Company has a set of third-party risk management tools through which it monitors for cybersecurity risks and threats associated with its third-party service providers. The Incident Response Plan includes processes that define how the Company manages and responds to such risks or threats associated with its third-party service providers.


text: The Company contracts with reputable third parties to conduct annual external assessments of its cybersecurity program and its components. Government agencies and their contracted agents also conduct periodic reviews in certain jurisdictions where the Company operates. Insurance agents, customers and other market participants routinely assess the Company's security posture relative to their own standards.


text: Security Policy and Requirements The Company has an Information Security Policy and Information Security Standards, which, taken together, describe the standards and minimum requirements that are expected of all business and information security personnel to protect the Company's information and technology assets. The policy provides a framework guided by security principles designed to address the confidentiality, integrity and availability of the Company's information assets in the context of internal, external, deliberate and accidental threats, while supporting the Company's information creation and sharing needs.


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The


text: 36 MOODY'S 2023 10-K Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with ISO 27001 and SOC 2 certification and attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.


text: The Company's cybersecurity program also includes an information security training and awareness program called InfoSafe for all employees. The program includes annual certification to having read and understood the Company's IT Use Policy, continuing education on phishing awareness, regular communications about cybersecurity best practices, and participation in annual events like Cybersecurity Awareness Month. Employees are expected to complete annual cybersecurity training, and compliance is monitored. The Company uses general and targeted phishing simulations to help employees better recognize and respond to potential threats. The training program is further enhanced by cybersecurity experts speaking at educational events. The Company also offers specialized training modules on emerging cybersecurity threats for its software development teams. The Company's IT Use Policy outlines a detailed escalation process under which employees are to immediately report any suspected cybersecurity incident.


text: The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of talent recruitment and retention, as well as procuring and deploying the correct tools to address threats. Additional information on cybersecurity risks is discussed in Item 1A of Part I, "Risk Factors," under the heading "Technology Risks," which should be read in conjunction with the foregoing information.


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2024, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.


text: The Cyber Committee, chaired by the CISO, and whose members include the CTSO, CAO and Chief Risk & Resiliency Officer, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company's Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.


text: Risk Management and Strategy The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program (the Chief Risk & Resiliency Officer) sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee.


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with the ISO 27001 certification and SOC 1 and SOC 2 attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.


text: Cybersecurity Risk Management and Strategy Republic's technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Cybersecurity organization, led by our Chief Information Security Officer (CISO), is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CISO has over 20 years of information technology, information technology audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our Cybersecurity organization proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: a. A formal enterprise-wide cybersecurity policy and related standards; b. Cybersecurity training and employee phishing simulations; c. Scheduled and ad hoc internal and external penetration tests; d. Cyber incident response, IT disaster recovery, and business continuity plans; e. Cybersecurity assessments and remediation planning as part of our M&A due diligence process; f. Identity and access management controls;


text: g. Third-party risk assessment and management for vendors and third-party service providers; and h. Cyber incident tabletop exercises for our Board of Directors and management.


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including to monitor compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.


text: For control efficacy, the cybersecurity program leverages a variety of metrics and measurements to demonstrate whether the control objectives are being consistently achieved within the target range. Monthly security operation (SecOps) reviews are utilized to monitor metric trends and root causes to determine potential capability improvements. The monthly SecOps reviews and related actions are aggregated into a subset of key metrics reviewed quarterly by the Audit Committee.


text: Cybersecurity Governance Our Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our CISO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, penetration testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our CISO and our third-party cybersecurity consultant to review our cybersecurity strategy and the results of our NIST CSF assessment. In accordance with our cybersecurity incident response plan, our Board is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with customers." in Item 1A of this Annual Report on Form 10-K.


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.


text: Risk Management and Strategy To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Senior Vice President and Chief Information Officer (the "CIO"), who in turn reports to the CFO.

companyName: CARTERS INC

ticker: CRI


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual assessments, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;


text: •"Table-top" simulation exercises involving the Company's management and its third-party consultants and advisors to simulate a cyber incident and the Company's response to that incident, pursuant to the Company's Incident Response Plan; and • Payment card industry ("PCI") audits to assess the Company's processing of credit card transactions pursuant to standards adopted by the PCI.


text: In addition, to mitigate material risks from cybersecurity threats, the Company has implemented various controls, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CISO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".


text: The Company has also implemented processes for overseeing and identifying risks from cybersecurity threats associated with its use of third-party service providers. For example, the Company has implemented the following: • Vendor onboarding processes including a Privacy Impact Assessment and a Cyber Security and Compliance Questionnaire; and • Enrollment of each vendor in a third-party risk monitoring tool that alerts the CISO's team should that vendor's security posture change.


text: The Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 25 years of experience in Retail, Consumer Products, Merchandising, Supply Chain and IT, of which 15 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: The Company's management maintains and implements a written Incident Response Plan, which is reviewed and updated on an annual basis and includes an Incident Response Plan Executive Committee consisting of the Company's CIO, CISO, and General Counsel. In addition, members of the CISO's and CIO's teams monitor the Company's systems and processes and promptly report incidents as required under the Incident Response Plan, including, but not limited to, reporting to the appropriate members of management and, as needed, the Audit Committee.


text: The Incident Response Plan has been developed to align with the four phases for the security handling lifecycle set forth in the National Institute for Standards and Technology Special Publication 800-61: (1) Preparation, (2) Detection & Analysis, (3) Containment Eradication & Recovery, and (4) Post-Incident Activity.


text: Risk Management and Strategy To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Executive Vice President, Chief Information & Technology Officer (the "CITO"), who in turn reports to the CEO.


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual audits, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents incurred either by us or third parties, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".


text: T he Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 30 years of experience in Retail, Consumer Products, Merchandising, and IT, of which 16 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: We rely on our information technology ("IT") and operational technology ("OT") systems, as well as systems of third-party vendors, to conduct our business. These systems are subject to possible cybersecurity threats. Cyberattacks are becoming more sophisticated, and U.S. government warnings have indicated that infrastructure assets, including pipelines and related infrastructure, may be specifically targeted by certain groups. These attacks include, without limitation, malicious software, ransomware, attempts to gain unauthorized access to data, and other electronic security breaches. Cybersecurity threats, which could increase as a result of geopolitical events, may be perpetrated by state-sponsored groups, "hacktivists," criminal organizations, private individuals and others.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: Cybersecurity Risk Management and Strategy We consider the risks from cybersecurity threats to include, without limitation, disruptions to our business operations, theft of protected information or intellectual property, destruction of our control systems and data, losses from remedial actions, damage to our reputation, and exposure to lawsuits and regulatory actions. In general, such risks are based on the capabilities and intent of known bad actors as well as threat information gathered from multiple sources, including industry groups, government agencies, publications and third-party service providers. Our processes for managing these risks generally involve (i) the use of tools and technologies to continuously monitor for and identify system vulnerabilities and attacks; (ii) adherence to policies and procedures designed to protect our critical IT and OT systems; (iii) the use of an employee awareness program to promote cybersecurity education and company-wide support; and (iv) periodic reassessment of areas of focus to maintain continued preparedness relative to changes in tools and technologies as well as emerging threats.


text: Our processes for identifying, assessing and managing the risks from cybersecurity threats are a key component of our overall cybersecurity strategy, which is designed to safeguard technology critical to providing services for our customers, and protecting business-sensitive and personal information that is entrusted to us. To help execute our cybersecurity strategy, we have adopted a risk-based, layered, defense-in-depth approach, which, among other measures, includes: (i) the segregation of our critical industrial control systems (Operational Technology or OT systems) from our corporate network; (ii) multiple layers of preventative and detective measures; (iii) a cybersecurity incident response plan to promote preparedness; and (iv) a cross-functional cybersecurity steering committee (the "Cybersecurity Committee") to provide guidance around cybersecurity risk management. Our overall cybersecurity program is based on various industry-recognized frameworks and standards developed and issued by leading international, domestic and energy-industry standard-setting organizations.


text: As part of our overall cybersecurity strategy, we also engage third-party service providers to: (i) assist in our cybersecurity risk assessment procedures; (ii) perform penetration testing on external facing IT systems; (iii) perform security assessments on our IT and OT systems; (iv) assist in our incident response procedures; and (v) share information on industry-specific cybersecurity threats. With respect to our use of third-party systems, we oversee our risks from cybersecurity threats by working with our third-party vendors to evaluate their cybersecurity program for alignment with our own policies and procedures, including notification of and coordination during any incidents that might affect us.


text: To the extent our processes for overseeing risks are effective in eliminating cybersecurity threats or mitigating the impact of an unforeseen incident, we generally do not expect these risks to have a material impact on our business strategy, financial position, or results of operations. However, as mentioned in Part I, Item 1A. Risk Factors, we do not carry insurance specifically for cybersecurity incidents. If we were to incur a significant liability for which we were not fully insured, it could have a material adverse effect on our financial position, results of operations and cash flows.


text: For information on the risks we face from cybersecurity threats, please see the risk factors included under Part I, Item 1A titled " A cyber-attack on our IT or OT systems could affect our business and assets, and have a material adverse effect on our financial position, results of operations and cash flows. " and " Failure of our critical IT or OT systems could have an adverse impact on our business, financial condition, results of operations and cash flows, as well as our ability to pay cash distributions. "


text: Cybersecurity Governance Our Cybersecurity Committee is comprised of senior representatives from our legal, IT and OT, engineering, corporate security, risk, human resources, finance, accounting, public relations, investor relations and executive management teams. This committee plays a key role in assessing and managing our risks from cybersecurity threats. In particular, our Cybersecurity Committee is responsible for: (i) establishing and promoting company-wide support for the management of cybersecurity risk; (ii) providing oversight and ensuring alignment between our cybersecurity strategy and business objectives; (iii) reviewing and advising on cybersecurity policy and governance; (iv) providing a forum for review of cybersecurity risk in alignment with our business objectives and risk tolerance; (v) promoting cross-company alignment of cybersecurity programs and actions; and (vi) reviewing our cybersecurity incident response plan ("CIRP"). Our Cybersecurity Committee meets at least quarterly with senior representatives from our cybersecurity team and outside experts to discuss cybersecurity threat updates, new cybersecurity regulations, cybersecurity projects and entity-wide results of cybersecurity preparedness initiatives. If a cybersecurity incident occurs, our Cybersecurity Incident Response Team, which includes several members of our Cybersecurity Committee, will oversee the execution of our CIRP.


text: Our Board has oversight of all material risks relevant to Enterprise, including those related to cybersecurity threats. To help keep our Board informed about such risks, senior representatives from our IT and OT department provide quarterly updates to our Board regarding significant developments in: (i) cyberattacks and other cybersecurity threats targeting critical infrastructure; (ii) governmental enforcement actions and investigations against cyber criminals; (iii) the regulatory landscape impacting the midstream energy industry; (iv) improvements to our cybersecurity programs, including our CIRP and related response procedures, and the progress of ongoing cybersecurity projects.


text: We recognize that effective cybersecurity governance is an on-going process, and thus, encourage those individuals with oversight responsibilities to stay abreast of emerging cybersecurity threats as well as pursue cybersecurity education opportunities. To this end, a number of our Cybersecurity Committee members, particularly the IT and OT representatives, hold one or more industry-recognized information security certifications such as the CISSP, CISM and CISA.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the oversight of our board of directors. Our executive officers are senior Blackstone Real Estate professionals and our Manager is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan, the IRP, designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of our Manager or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our board of directors is responsible for understanding the primary risks to our business. The audit committee of our board of directors is responsible for reviewing our and our Manger's IT security controls with management and evaluating the adequacy of our and our Manager's IT security program, compliance and controls with management.


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or the audit committee annually on cybersecurity matters, including risks facing us and our Manager and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Manager and the measures we and our Manager are taking to mitigate such risks, as well as on changes to our and our Manager's cybersecurity risk profile or certain newly identified risks.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations " in this Annual Report on Form 10-K.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity program strategy, which applies to us.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Our CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Our CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Cybersecurity Risk Management, Strategy and Governance We rely upon information technology (IT) networks and systems to process, transmit and store electronic information, and to manage or support a variety of critical manufacturing and business processes or activities. Additionally, we and certain of our third-party vendors collect and store personal or confidential information, including personally identifiable information, in connection with human resources operations and other aspects of our business. The secure operation of these information technology networks and systems and the proper processing and maintenance of this information are critical to our manufacturing and business operations.

companyName: Dauch Corp

ticker: DCH


text: We have developed and implemented robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.


text: In addition, the AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Security Officer (CISO), our frontline business leader with regard to cybersecurity risk management. AAM's CISO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.


text: Further, in support of our information security program, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) consultants to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) auditors to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's CISO manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.


text: Our Board of Directors and its committees play an active role in overseeing our key risks. Our cybersecurity risk management processes and strategy are governed by the Audit Committee of our Board of Directors. Management provides quarterly reports to the Audit Committee that include, among other items: 1) AAM's cybersecurity scorecard, which includes certain key performance indicators (KPIs) and provides quantitative measures of these KPIs; 2) industry security trends and outlook; 3) an update on AAM's security program and roadmap; 4) current quarter IT security accomplishments; and 5) IT security priorities for the following quarter. In addition, on an annual basis, management reports to the Audit Committee the results of our system availability and disaster recovery testing for AAM's enterprise systems, as well as the results of our incident response testing and corresponding action plans.


text: Although no cybersecurity incidents during the year ended December 31, 2023 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We rely upon information technology (IT) networks and systems to process, transmit and store electronic information, and to manage or support a variety of critical manufacturing and business processes or activities. Additionally, we and certain of our third-party vendors collect and store personal or confidential information, including personally identifiable information, in connection with human resources operations and other aspects of our business. The secure operation of these information technology networks and systems and the proper processing and maintenance of this information are critical to our manufacturing and business operations.


text: We have developed and implemented our Information Security Management System (ISMS), which includes robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.


text: Our ISMS leverages comprehensive cybersecurity frameworks and standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Critical Security Controls, the Trusted Information Security Assessment Exchange (TISAX) standard, and the International Organization for Standardization (ISO) 27001 standard for information security. Our ISMS is built upon a balance of people, processes and technologies comprised of, among other elements: 1) 24/7 security monitoring using internal and third-party resources; 2) security awareness and phishing testing; 3) periodic table-top and live-fire exercises; 4) high system availability and business continuity; and 5) comprehensive incident response and escalation plans.


text: Further, in support of our ISMS, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) third-party experts to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) leveraging third-party expertise to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's Chief Information Security Officer (CISO) manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.


text: Cybersecurity Governance The AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Officer (CIO) and CISO, our frontline business leaders with regard to cybersecurity risk management. AAM's CIO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.


text: Although no cybersecurity incidents during the year ended December 31, 2024 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity threats when they occur.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: Our cybersecurity program is focused on the following key areas: • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, an endpoint protection platform system, anti-malware functionality, email filtering, url filtering and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats, as well as periodic decoy and honeypot testing, as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Assessments of Third Party Service Providers. We regularly evaluate the cybersecurity policies, standards, processes and practices of our key third party service providers in order to effectively identify and address any vulnerabilities or other risks. • Incident Response and Recovery Planning. We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Collaborative Approach. We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our executive management and board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.