text: Cybersecurity Risk Strategy We drive an aggressive cybersecurity roadmap aligned to internationally recognized cybersecurity frameworks and focused on evolving global threats, new cybersecurity insurance requirements and continuous improvement of incident response. Our cybersecurity program is aligned with the NIST Cybersecurity Framework and we also maintain ISO 27001 certification. Pursuant to the framework, we utilize industry leading cyber solutions and techniques to prevent, detect, and respond to incidents using a layered security model. We conduct an annual gap assessment against the NIST Cybersecurity Framework, the results of which are used to establish goals and measure progress against our cybersecurity roadmap. Based on the gap assessment, for example, we have taken a number of actions intended to reduce our cybersecurity risk, including enhancing our email and end-point security programs, implementing a single dashboard for security monitoring and improving our web application filtering programs. We are focused on the continuous improvement of key processes such as data security, asset management, access control, vulnerability management, incident response, and third-party risk management. We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes, including as a result of a cybersecurity breach.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Our Information Technology (IT) team is responsible for our cybersecurity monitoring and leverages a 24x7 Managed Detection & Response (MDR) third-party vendor to provide real-time cybersecurity threat monitoring and incident response, as well as to conduct a quarterly risk assessment. Pursuant to our incident response policy, any identified cybersecurity threats are immediately evaluated for the level of potential risk to us, with our response and remediation plan based on the potential severity of the incident. This incident risk assessment is continuously updated as we become aware of any new information regarding an identified incident. Pursuant to this plan, we will also utilize third-party experts to help identify, contain and remediate any incident that could have a significant impact on us. In addition, we use third-party experts to assist us in performing annual penetration testing and active breach assessment simulations to verify implementation of security tools, mitigating controls, and our ability to respond to real-world scenarios pursuant to our incident response policy.

secItem: Item 1C


text: As part of our cybersecurity roadmap, we also assess third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We are highly focused on cybersecurity awareness and perform annual certification of our employees, execute ongoing phishing campaigns, intervene with phish-prone individuals, publish monthly cybersecurity newsletters, and participate in Cybersecurity Awareness Month, in October each year.


text: Cybersecurity Risk Governance Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board of Directors in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of cybersecurity risk to the Audit Committee and the Audit Committee reports on its activities and findings to the full Board of Directors. Key cybersecurity topics are presented regularly to the Audit Committee. In addition, if any cybersecurity incident is determined under our incident response policy to pose a risk in excess of an identified threshold (as set forth in the policy), our Chief Legal Officer will promptly notify the Audit Committee regarding the incident. The notification to the Audit Committee will include management's determination regarding whether or not the incident is material to us.


text: On an operating level, our cybersecurity program is managed by a dedicated Chief Information Security Officer (CISO), reporting to our Chief Information Officer (CIO), who together lead a geographically dispersed team comprised of our employees, highly skilled contractors and other key functional third-party resources. Our CISO holds a Masters of MIS in Information Security and prior to joining Ribbon, served as the Director of Information Security & Privacy at Ericsson for the Americas. Prior to Ericsson, she held cybersecurity positions at Walgreens, Fortunes Brands Home & Security, and W.W. Granger. She is a Certified Information Security Manager, has operated her own security firm, and has over 20 years of cybersecurity experience, including her time as a US Navy Operations and Training Manager. Our CIO has held that position (or Head of IT) at Ribbon for over seven years. He has over 25 years of experience in the IT area including over nine years overseeing IT cybersecurity, cybersecurity roadmaps and IT general controls. During his career he has overseen initial ISO 27001 certifications, as well as the implementation of over 30 cybersecurity platforms. The CIO and CISO are part of our cybersecurity council, which also includes our CEO, CFO and other key leaders. The cybersecurity council meets monthly to review the cybersecurity metrics, new potential threats, and progress against the cybersecurity roadmap. Key matters from these monthly council meetings are presented to the Audit Committee.


text: Forming a Security Council Committee (SCC), which consists primarily of members of our management team and IT department, to develop and oversee our cybersecurity policies and infrastructure and establishing a multi-tiered reporting and governance system pursuant to which our SCC reports to our Service Center Board, which reports to our Risk Committee, which reports to our Board;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Implementing MFA protections for our treasury customers by prohibiting their initiation of ACH transactions or wire transfers until they authenticate their identities using a security token that is generated and sent by our online-banking MFA system;


text: Communicating awareness and education of security risks, social engineering and scams affecting our customers through targeted marketing and social media messaging strategies and campaigns; Monitoring electronic mail and other network intrusion attempts with various tools to identify and stop intrusion and malware threats;


text: Security Council Committee. As part of our cybersecurity governance framework and for purposes of establishing and maintaining our ISSP, we have established an SCC, which consists of members of our management team and IT department. The SCC is subject to oversight by the Service Center Board, the Risk Committee, and the Board. The Risk Committee of the Board works directly with the SCC to develop and implement our policies and procedures concerning cybersecurity and data protection. As stated in the Risk Committee Charter, our Risk Committee reviews management reports on the adequacy of our data-governance activities and IT security program; evaluates risks related to customer information, significant outsourcing with third parties or Vendors, and operational outsourcing arrangements; reviews, evaluates, and updates our data-governance framework, processes, and systems for identifying, assessing, and managing data risks that impact critical business operations; and reviews and evaluates our overall risk-management framework.


text: The SCC meets at least quarterly to discuss its oversight of our cybersecurity policies and procedures, risk-management practices and controls, and efforts to mitigate and prevent cybersecurity risks. The SCC may meet more frequently if required by our Incident Response Plan to facilitate timely response, monitoring, risk-management, and recovery efforts. The SCC is also charged with periodically reporting to management, the Board, and the Risk Committee, the status, and results of our compliance with our security program, results of security assessments, and effectiveness of remediation activities.


text: Other Committees. In addition to the SCC and Risk Committees, we have established a Technology Committee, a Senior Management Committee, and a Business Continuity and Disaster Recovery (BC/DR) Committee. Each oversees aspects of our ISSP and coordinates with the SCC to implement various cybersecurity procedures.


text: Chief Information Security Officer. In addition to establishing the SCC and other committees, we designated a Chief Information Security Officer (CISO) to oversee all aspects of our IS policies, procedures, and controls. Our CISO reports to our Senior and Executive Management Committee, the SCC, the Risk Committee, and the Chairman of the Board. At least annually, the CISO presents all of our IS policies to the Board. The CISO is also tasked with maintaining an effective Security Awareness Program and providing training to our management, Board, and employees on an annual basis. Additionally, the CISO meets with our Audit Committee on a quarterly basis to inform them of material cybersecurity-related regulatory updates and with our full Board on a monthly basis to discuss and provide pertinent regulatory information.


text: At the CISO's direction, the IT Security and Engineering Teams gather intel regarding the incident and take pre-planned steps to mitigate harm, address system weaknesses, and block ongoing threats. For example, our network engineers analyze network traffic for external attacks, search for signs of a firewall breach, and take action to block a suspected intruder's network traffic; our security analysts and engineers look for indications of an attack or suspicious activity by monitoring and reviewing the network activity of our business applications and the audit logs of our mission-critical servers; and our systems administrators examine system logs of our critical systems for any abnormal activity, confirm our mission-critical computers are up to date on all service packs and patches, and ensure backups have been created for our critical systems. The CISO reports the incident to our executive management team, Service Center Board, and SCC.


text: Our CISO, executive management team, Service Center Board, and SCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.


text: Risk Management and Strategy Liberty Broadband's corporate level Information Technology ("IT") and cybersecurity functions are provided by Liberty as part of the services agreement described in Part I, Item 1. "Business." Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter's cybersecurity functions rests with its board of directors and Audit Committee.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the NIST CSF.


text: For additional information on our cybersecurity risks, see Part I, Item 1A. "Risk Factors" under the section entitled "Cyberattacks or other network disruptions could have an adverse effect on our company and GCI's business" in this Annual Report on Form 10-K.


text: Role of Management Through our services agreement with Liberty discussed in Part I, Item 1. "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: Our CFO is informed about and coordinates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our C EO and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our MIT regularly reports to and reviews our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.


text: In the event of a cybersecurity incident, we maintain an incident response plan in an effort to contain and mitigate the threat. As part of our incident response plan, our Cybersecurity Incident Response Team (a cross-functional taskforce comprised of senior representatives), is responsible for convening to assess the potential impact to our business, including financial reporting requirements and legal implications.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: We, like other companies in our industry, face a number of cybersecurity risks, including cybersecurity incidents, in connection with our business. Although such risks and incidents have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors."


text: At the management level, our Head of Information Technology is responsible for assessing and managing risks from cybersecurity threats through oversight of our information technology infrastructure and cybersecurity program. The individual occupying this role has over 20 years of experience in information technology and cybersecurity and has served in senior cybersecurity leadership positions for over 10 years. Our Head of Information Technology conducts bi-weekly meetings with our information technology department to remain apprised of cybersecurity matters. In the event of a cybersecurity incident, our Head of Information Technology may inform our Executive Vice President and Head of Technological Operations and/or Audit Committee, depending on the severity of the incident in accordance with the established severity and response matrix as defined in our incident response plan.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of Payoneer's control infrastructure and is included as an overall risk in our enterprise risk management program. Payoneer's cybersecurity risk management program is designed to align with industry best practices like National Institute of Standards and Technology ("NIST") and Control Objectives for Information Technology ("COBIT") which help provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Risk Committee of the Board of Directors (the "Risk Committee") of material cybersecurity threats and incidents. Our cybersecurity team is responsible for assessing our cybersecurity risk management program considering industry best practice and aligning to regulatory requirements and engages with third-party security experts for advisement on cybersecurity risk assessments and system enhancements. In addition, our cybersecurity team provides training to employees on a periodic basis.

companyName: Payoneer Global Inc.

ticker: PAYO


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Risk Committee. The Risk Committee is responsible for reviewing our cybersecurity and the protection of data integrity policies and practices, including making recommendations for improvements in these areas. The Risk Committee oversees that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Risk Committee also reports material cybersecurity risks to our Audit Committee, as the case may be, and material cybersecurity incidents would be reported to the full Board of Directors by management and/or the Risk Committee.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored and escalated appropriately, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Our CISO has more than 25 years of experience in various roles related to information security and technology, including 14 years as CISO and other leading cyber security roles in the fintech industry. Management, the CISO and our cybersecurity team, periodically update the Risk Committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We operate in an increasingly interconnected digital landscape and we recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. In the normal course of business, we may collect and store certain sensitive information, including proprietary and confidential business information, intellectual property, sensitive third-party information, employee information and other personal information. We rely on our own information systems and third-party information systems for the management of this information in addition to our management of business processes including inventory, payment of obligations, collection of cash, human capital management, financial tools and other processes and procedures. Our ability to manage our business effectively depends on the reliability, security and capacity of these systems. We seek to address these risks by safeguarding assets, data, and operations through the cybersecurity risk management processes described below: Risk Assessment:

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: The above cybersecurity risk management processes are integrated into the Partnership's overall risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered an important component of our enterprise-wide risk management approach. We have assembled a Cybersecurity Steering Committee comprised of IT management, cybersecurity specialists, and representatives of business management, including the CTO and internal legal counsel. The Cybersecurity Steering Committee reviews information security policies and cybersecurity risks in conjunction with other operational, financial, and strategic risks to ensure alignment with our business objectives. The Cybersecurity Steering Committee convenes regularly to review and monitor the Partnership's programs for the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Cybersecurity Steering Committee receives reports on security incidents, threat intelligence, and vulnerability assessments from our IT Security Department.


text: Impact of Risks from Cybersecurity Threats The energy industry increasingly depends on information and operational technology to sustain critical functions. However, the rise in cybersecurity incidents, whether caused by deliberate attacks or accidental events, poses substantial challenges. As these threats grow in complexity and scale, the industry's efforts to prevent, detect, mitigate, and remediate such incidents become progressively more demanding and complex.


text: During 2024 and through the date of this Annual Report on Form 10-K, though the Partnership and our service providers may have experienced cybersecurity incidents, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Partnership, including our business strategy, result of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our IT Security Department aims to monitor and assess these risks to maintain the security and continuity of our operations. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. Please see "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: To support our preparedness, we have constituted a Cybersecurity Review Committee ("CRC") and adopted a written incident response plan ("IRP"). The CRC is comprised of cross-functional personnel including Reliance's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO"), General Counsel and Vice President, Enterprise Risk. In the event of a cybersecurity incident, our CRC refers to our IRP and existing management internal controls processes. Pursuant to these prescribed processes, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon reporting obligations, escalating information about the incident to senior management and potentially representatives from the Board, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises to test our incident response procedures, identify cybersecurity gaps and vulnerabilities and improvement opportunities and exercise team preparedness.

companyName: RELIANCE, INC.

ticker: RS


text: Reliance mandates regular cybersecurity training for employees and applicable contractors designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training covers various cyberattack methodologies, including insider attacks, phishing and other forms of social engineering, and other email attacks, malware attacks, data protection, data handling, password protections, cloud and internet security and cybersecurity fundamentals for mobile devices. We take a risk-based approach with respect to our use and oversight of third-party service providers, using a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors, and negotiating for cybersecurity-related terms in vendor agreements as appropriate. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.


text: Cybersecurity Risks Like other complex corporations, Reliance is the target of cyber-attacks from time to time, which have to date been immaterial individually and in the aggregate to our business strategy, results of operations or financial condition. There can be no assurance that any future cybersecurity incidents will not be material to our business. For additional information about risks related to cybersecurity, please see the risk factor set forth under the caption Item 1A. "Risk Factors" the Risk Factor captioned " We rely on information management systems and any damage, interruption or compromise of our information technology management systems, networks or data could disrupt and harm our business."


text: Roles and Responsibilities Cybersecurity is an important element of our risk management processes and an area of particular focus for Reliance's Board of Directors and management. The Company's CIO serves as single point of communication and coordination for protecting the Company and its digital information. The CIO performs an initial assessment of each reported cyber incident and escalates all non-trivial cybersecurity incidents and risks to the CRC. The CRC is primarily responsible for assessing and managing material risks from cybersecurity threats and is comprised of a cross-functional team including the CIO, as well as senior representatives from the Company's risk management, finance and legal functions. The CIO has 15 years of experience in managing of cybersecurity.


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the enterprise risk management processes and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management processes.


text: The Board has designated the Audit Committee to be responsible for oversight of cybersecurity risk. The Audit Committee receives regular reports from the CRC and the CIO that may discuss topics such as prior assessments, cybersecurity trends, prior cybersecurity events, and planned enhancements. In addition, the Audit Committee also receives regular periodic reports regarding information technology general controls in connection with its oversight of internal control over financial reporting. The Chair of the Audit Committee regularly briefs the Board on these matters.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data"). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework. Cybersecurity risks are assessed and managed alongside other material risks, including financial, operational, legal, and strategic risks, to ensure a comprehensive approach to risk oversight.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Attacks are increasingly sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Accordingly, risks related to a cybersecurity event, including litigation and enforcement risks, are elevated due to the dynamic nature and sophistication and frequency of these threats.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Brent Winn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Winn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2020. Mr. Winn currently oversees key functions for our company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Winn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any material cybersecurity incidents to our Board.


text: Our cybersecurity efforts are managed through third-party service providers and third-party software providers who will notify Mr. Winn of a significant cybersecurity incident report that details the nature of the incident, the measures taken to mitigate its impact, and the steps implemented to remediate the situation. We receive periodic summary reports from our providers that outline emerging threats, trends, and the overall effectiveness of our current cybersecurity controls. These processes ensure that Mr. Winn remains actively informed and engaged in overseeing the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls in an effort to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes aimed at providing for the availability of critical data and systems, maintaining regulatory compliance, identifying and managing our risks from cybersecurity threats, and protecting against, detecting, and responding to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework (however, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business); use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We, and our third-party service providers, are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incident; if we or our third-party providers fail to protect confidential information and/or experience a cyber incident, there may be damage to our brand and reputation, material financial penalties, and legal liability." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not identified any known cybersecurity threats including as a result of any prior cybersecurity incidents, that have materially impacted us, including the expenses we have incurred from cybersecurity incidents that were immaterial. This includes penalties and settlements, of which there were none. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and information security processes and business policies impacting our overall cybersecurity risk.


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Network Security.


text: Our Chief Operating Officer and General Counsel manage the cybersecurity risk management program. The Vertex Executive Leadership Team has oversight over their management and the program. Our Chief Operating Officer is responsible for managing and mitigating our material risks from cybersecurity threats. His team of information security professionals manage our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Operating Officer has over twenty-five years of leadership experience in global business operations, including information security and compliance. Our General Counsel has overall management responsibility of cybersecurity risks. His team of attorneys and certified risk professional assess cybersecurity risks, assist the information security team with mitigating identified risks, and aligns the management of cybersecurity risks with the management of enterprise risks. Our General Counsel's experience includes over twenty years in positions of leadership in global organizations supervising compliance and risk professionals.

companyName: Vertex, Inc.

ticker: VERX


text: Risk Management and Strategy. The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing where possible, and mitigating cybersecurity threats, and responding to security incidents when they occur. We also maintain controls and procedures that enable prompt escalation of certain cybersecurity incidents so decisions about public disclosure and reporting of such incidents can be timely made.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Risk Assessment and Remedial Measures. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting security controls to address such risks.


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the specific systems, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring using security information and event management (SIEM), multi-factor authentication (MFA), vulnerability and patch management, third-party dark web monitoring and threat-intelligence services.


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. The testing conducted by our in-house security teams includes audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. Individual controls are evaluated and periodically improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Company's Chief Security Officer ("CSO") works collaboratively across the Company with other members of TTEC's leadership team to implement cybersecurity programs designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents, among other events that require resilient response. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.


text: Education and Awareness. The Company requires employees to complete periodic mandatory training on cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks. The full impact of security events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Governance. The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's CSO (who maintains chief information security officer ("CISO") responsibilities at TTEC among other responsibilities), Chief Information Officer ("CIO"), the Chief Privacy Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee of the Board receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, and the steps the Company is taking to address the security risks, among other relevant information, and shares information with the full Board as appropriate. The Board also has access to and periodically meets with the Company's CSO, CIO, and Chief Legal & Risk Officer about the approaches and progress that the Company is making on its cybersecurity risk management priorities.


text: The Board and the Security & Technology Committee also receive prompt information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed.


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical studies, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, Information Systems and Data).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Senior Director of Information Technology (IT), internal IT, information security and legal functions, and third-party service providers (collectively, Cybersecurity Team) help identify, assess and manage our cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our management and its designees report to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we have implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Liberty's corporate level IT and cybersecurity functions assess, identify, and manage risks from cybersecurity threats at the corporate level, while Formula 1 and QuintEvents operate their own cybersecurity functions with oversight from Liberty.

companyName: Liberty Media Corp

ticker: FWONA


text: Live Nation, an equity affiliate, as a separate publicly traded company from Liberty, operates its own cybersecurity function. Oversight for Live Nation's cybersecurity functions rests with its board of directors, of which an employee of Liberty is a member, in collaboration with Live Nation's Global Data Governance Board and Audit Committee.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level, Formula 1 and QuintEvents. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: Role of Management We have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: Our management team's experience includes a diverse background in telecom, technology, media and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Formula 1's Head of Information Security and Director of IT together have more than 30 years of experience and the Head of Information Security has multiple certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. All have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Risk Management and Strategy We have designed and implemented a cybersecurity program which includes administrative, technical, and physical controls and processes to manage and mitigate material risks from internal and external cybersecurity threats, including but not limited to the following: A team responsible for designing, implementing, and continually improving our policies, procedures, and technology. A risk management process to identify, assess, and treat internal and external ( third-party) cybersecurity risks.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: An incident management program to effectively and efficiently identify, review, and escalate incidents with the appropriate stakeholders (e.g., CEO, CFO, Legal, Finance, and others, as required).


text: A vulnerability management program to scan and penetration test, on an ongoing basis, our systems and networks to identify and treat identified vulnerabilities.


text: A security awareness program that educates our team members on an ongoing basis on internal security policies and secure behaviors.


text: Engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security program.


text: Periodically reporting risks, previous and current incidents, and ways to mitigate risks to the Chief Executive Officer, the Audit Committee of the Board of Directors, and other members of senior management.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. Refer to Item 1A – " Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches " and " We are dependent on information technology, systems, infrastructure and data," which are incorporated by reference into this Item 1C. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.


text: Risk Management and Strategy QVC Group's corporate level IT and cybersecurity functions are provided by LMC as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in LMC's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. QVC operates its own cybersecurity function with oversight from QVC Group.

companyName: QVC Group, Inc.

ticker: QVCGA


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultant s, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: Role of Management Through our services agreement with LMC discussed in Item 1, "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and at QVC.


text: Our management team's experience includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together, this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Our cybersecurity function, led by our head of IT and supported by third -party service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of our threat environment, evaluating our and our industry's cybersecurity risk profile, evaluating threats reported to us, completing internal and external cybersecurity audits, completing third-party cybersecurity threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and tabletop incident response exercises.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, data hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, security questionnaires and the imposition of contractual obligations related to cybersecurity on the provider.


text: Our executive management team, with regulatory and governance oversight from our Audit Committee, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our cybersecurity function, led by our head of IT and supported by our third-party service providers, is responsible for our cybersecurity risk management and strategy processes. These functions have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our cybersecurity incident response plan provides for escalation of certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CDO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our incident response team also reports material cybersecurity incidents to the Chair of the Audit Committee.


text: Overall, we devote resources to network security, data encryption, employee training and other measures to protect our systems and data from unauthorized access or misuse. This includes the emerging need to protect our data from the unauthorized incorporation in large language models or other artificial intelligence systems. The Audit Committee and full Board of Directors receive quarterly reports on cybersecurity risks and annual reports on management initiatives to promote cybersecurity.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and attesting to our risk management systems, including an annual Systems and Organization Controls 2, or SOC 2, audit with respect to the security, availability, confidentiality, and process integrity trust services criteria, or TSC. Our collaboration with these third-party service providers includes regular audits, threat assessments, and consultation on cybersecurity strategy and enhancements. Recognizing the risks associated with these and other third-party service providers, we also conduct risk assessments on selected systems and third-party service providers on an ongoing basis.

companyName: Natera, Inc.

ticker: NTRA


text: Risk Management and Strategy We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for periodic penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Solid Power, Inc.

ticker: SLDP


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee of the Board, and the Audit Committee of the Board receives routine updates on cybersecurity matters from our Director of Information Technology and other members of management. Our Director of Information Technology leads our cybersecurity efforts and has 15 years of information technology experience. There are no management positions directly responsible for overseeing our cybersecurity risk. Rather, our Director of Information Technology and our broader information technology department work closely with members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Risk management and strategy: Matson's information security, internal audit, business continuity and risk management teams help to identify and assess cyber and information security threats and vulnerabilities, and establish the appropriate business systems, preventive controls and risk mitigation strategies. The main objectives of Matson's approach to cyber and information security are to protect confidential information while maintaining data integrity and availability; support legal and regulatory compliance; and prevent disruptions to business operations. The Company regularly enhances its systems, controls and strategies in an effort to guard against security breaches and unauthorized access to Matson systems or data and develops policies to guide the appropriate handling and protection of sensitive information by Matson. This includes managing third-party supply chain risks with its key vendors and business partners. It also maintains incident response and remediation plans which provide that cybersecurity incidents be communicated to the Company's senior leaders who are responsible for assessing the risks associated with a cybersecurity incident and initiating the Company's incident response plan. The Company's incident response and remediation plans are further supported by ongoing security monitoring services as well as a dedicated management team focused on business continuity to help support operations and mitigate disruptions should a breach, unauthorized access or other disruption event occur. In addition, the Company has established a zero trust network access roadmap that includes key security controls designed to help protect Matson employees and contractors with access to Matson systems against phishing and brute force password attacks.

companyName: Matson, Inc.

ticker: MATX


text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes third-party audits to test its cybersecurity systems, incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's quarterly information security update to the Chief Executive Officer and Chief Financial Officer includes an update on the results of these reviews.


text: Since the beginning of the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "


text: Governance: The Board has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 18 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and the Chief Information Security Officer, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and the Chief Information Security Officer provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and the head of internal a udit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.


text: Managing Material Risks & Integrated Overall Risk Management The Company has integrated cybersecurity risk management into its broader risk management framework in order to promote a culture that values protecting sensitive information. This integration is intended to promote the inclusion of cybersecurity considerations in decision-making processes throughout the Company. The Bank's general risk management personnel, including the Chief Risk Officer ("CRO"), work closely with their information technology and security counterparts to evaluate and address cybersecurity threats in alignment with our business objectives and operational needs.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Company also maintains a system-wide information security program that applies to all employees. All employees are expected to assist in safeguarding the Company's information systems and to assist in the detection and reporting of cybersecurity incidents. This Company-wide program is intended to identify and assess internal and external cyber and information security risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems or those of third-party providers from unauthorized access, use or other malicious acts.


text: Board of Directors Oversight Our information security program is designed to ensure adequate governance, and oversight is in place while evolving to meet changes in applicable laws and regulations, and industry best practices. Cybersecurity is a significant risk to the enterprise and matters related to information security are regularly featured as part of management's enterprise risk profile updates to the Risk Committee of the Board of Directors (the " Risk Committee "), which occur at least on a quarterly basis. The Chair of the Risk Committee reports to the Board of Directors on the committee's proceedings and activities, including in connection with the committee's deliberation on information security matters, on a regular basis. In addition to regular touchpoints on cyber matters at the Risk Committee, the Board of Directors receives briefings from the Bank's Chief Information Security Officer (the "CISO") semi-annually.


text: The Board of Directors directly, and through its standing committees (particularly the Risk Committee and the Audit Committee of the Board of Directors) also engage in broader discussions regarding existing and emerging operational and technology risks with members of management across all lines of defense. To supplement the Board of Directors' regular engagement regarding the Company's information security program, the director education program includes cybersecurity-related training opportunities, which assists the directors in staying current on developments and maintaining appropriate knowledge regarding the evolving cybersecurity and threat landscape.


text: Reporting to Board of Directors The CISO provides management, the Risk Committee and the Board of Directors with information regarding the Company's cybersecurity program and potential cybersecurity threats or incidents. In addition, the CISO is empowered to escalate material cybersecurity threats or incidents and strategic risk management decisions to the Board of Directors so that they can provide appropriate oversight and guidance on these critical cybersecurity issues within the context of the Company's overall strategic objectives and business operations. Management, the Company's Chief Digital Officer (the "CDO"), the CRO, and the Incident Management Team (the "IMT") are also required to report cybersecurity threats and incidents to the Risk Committee and/or the Board of Directors, as applicable.


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERMC"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERMC receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERMC's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.


text: The Information Technology/Information Security Steering Committee (the "IT Steering Committee") reports directly into the ERMC and meets at least quarterly. The IT Steering Committee is composed of senior members of management, including the CDO, the CRO and the CISO. The IT Steering Committee oversees information technology matters at the Company, including the implementation of all cybersecurity policies, standards, guidelines and procedures. The responsibilities of the IT Steering Committee include, among other things, updating the Company's information technology policies, reviewing the architecture of the Company's information system infrastructure and monitoring the progress of any significant hardware or software updates or installation. In addition, the IT Steering Committee provides quarterly reports to the ERMC and the Risk Committee regarding any information-technology-related matters that, in the opinion of the IT Steering Committee, should be escalated.


text: The CISO plays an important role in the prevention, detection, mitigation, and remediation of cybersecurity incidents and in informing management, the Risk Committee and the Board of Directors on cybersecurity risks and issues. The CISO provides quarterly briefings to the Risk Committee on any significant information security issues, relevant cybersecurity metrics and the status of the Company's security-related strategic initiatives. As discussed above, the CISO also provides mid-year and annual reports to the full Board of Directors regarding the state of the Company's information security program. The annual reports encompass a broad range of topics, including: Confidentiality of nonpublic information and the integrity and security of the Company's information systems; Cybersecurity policies and procedures; Material cybersecurity risks;


text: Any material cybersecurity incidents. In addition to these scheduled meetings, the Risk Committee, the CISO, the CDO, the CRO, and other members of management maintain ongoing dialogues with respect to emerging or potential cybersecurity threats. The Risk Committee also receives reports and updates from management regarding significant cybersecurity developments so that the Board of Directors can be promptly notified, as and when appropriate, of any threats or incidents as well as management's proposed responses.


text: Monitor Cybersecurity Incidents The IT Steering Committee, which is a subcommittee of the ERMC, established the Information Technology and Information Security Working Group (the "IT/IS Working Group"), which is comprised of the CDO, the Head of Information Technology Infrastructure, the CISO, the Information Security Officer, the Information Security Assurance Program Manager and certain other members of the Company's information technology engineering staff. The mission of the IT/IS Working Group is to foster the sharing of information among departments regarding existing and emerging threats and risks related to cybersecurity and related compliance issues in order to better integrate cybersecurity risk management and increase awareness of cybersecurity threats throughout the Company. This group meets on a weekly basis to discuss, among other things, vulnerability management, threat and risk analysis and the status of our continued enhancements to the Company's information security infrastructure that are intended to further manage and mitigate future risks.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing, from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers, and violations of data privacy or security laws.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards, and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling or processing our employee, business, or customer data.


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment, and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations, or financial condition.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not been aware of any material cybersecurity incidents occurring and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program using the NIST framework, as well as perform penetration testing.


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has over twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with us in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats. Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection. We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs. Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security. If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.


text: Our Board has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Board has delegated to the Audit Committee oversight risks of cybersecurity risk policies, practices and procedures. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our Board.


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Director of Cyber Security is our incident response team leader. In this position, our Director of Cyber Security oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Director of Cyber Security has nearly two decades of experience in cybersecurity management and policy, achieved through job training, college education, and work in security and alignment of information technology solutions.


text: The Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Director of Cyber Security. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.


text: During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Risk Management and Strategy In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners, and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security manages the Company's cybersecurity efforts and leads the cybersecurity team under the direct oversight of our Chief Technology Officer. These individuals, including all members of the cybersecurity team, have an average of over 16 years of experience involving information technology, including security, auditing, compliance, systems, and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation, and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity, and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented companywide security awareness training programs designed to provide best practices for protecting our network and systems, and routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks including risks associated with the Company's use of artificial intelligence. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance, and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations, or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any prior cybersecurity incident, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity threats and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.


text: Risk Management and Strategy Marine Products approaches cybersecurity as an enterprise-wide risk and has created a Cybersecurity Risk and Compliance Program that outlines governance programs in place and outlines efforts undertaken to mitigate cyber risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, the Company uses the Center for Internet Security ("CIS") Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: The Company has several security policies that are published and accessible to all employees. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. Marine Products has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine if further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors, outside legal counsel and our independent registered public accounting firm, as appropriate, including on materiality analyses and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions. The Company has a periodic touchpoint with all third-party information technology service providers to identify materials risks from cybersecurity threats.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with data breach or other similar incidents. Cyber liability insurance also provides coverage in the event of a ransomware attack. Our cyber risk coverage includes assistance in the timely remediation of material cyberattacks and incidents.