text: Responsibilities of the Board of Directors Our Board provides oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure and the mitigation and remediation of cybersecurity incidents, and our executive officers (including our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer) are responsible for the day-to-day management of the material risks we face, including cybersecurity risks. Our Board administers its cybersecurity risk oversight function as a whole, as well as through the Audit Committee ("AC"). Our corporate security team informs the Board and AC of certain cybersecurity risks and threats during quarterly meetings and provide materials shared in connection with such meetings, as well as ad hoc updates when there are material developments or changes that may impact cybersecurity risk to the company. Refer to "Item 10. Directors, Executive Officers and Corporate Governance" section of this Annual Report for additional information regarding the AC and other committees of the Board as well as the AC charter.


text: Responsibilities of Management Our corporate security team consists of the Chief Information Security Officer, the Manager of Security Engineering, a Senior Security Engineer, a Senior SRE, and a Security Engineering Contractor. The corporate security team is primarily responsible for assessing and managing material risks from cyber security threats, defining and overseeing our corporate security program, reviewing technical designs and vendors for security risks, and managing our security tools and infrastructure. Our corporate security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment, including those described in "Risk Management and Strategy." The corporate security team reports to the Senior Manager of Information Technology, who reports to the Senior Director of Engineering Operations which maintains responsibility for our cyber security program.

companyName: Life360, Inc.

ticker: LIF

secItem: Item 1C


text: Our Chief Information Security Officer provides frequent briefings to management regarding the Company's cyber security risks and risk-mitigation efforts, which may include recent incidents and related responses, newly identified risks, changes to the security program, and activities of third parties and vendors, as appropriate. Management provides cybersecurity updates to executive management and the Board through meetings and materials shared in connection with those meetings, as well as ad hoc updates when there are material developments or changes.


text: Index to Financial Statements The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be dynamic and to intersect with various other enterprise risks. As such, cybersecurity is considered an integral component of our enterprise-wide risk management approach. As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership.

companyName: PLAINS GP HOLDINGS LP

ticker: PAGP


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program, which includes administrative, technical and physical safeguards designed to maintain the confidentiality, integrity and availability of company and customer information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors (Board). We have an established process and playbook led by our chief information security officer (CISO) governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. We undertake periodic reassessments of the Company's risk profile and may make certain adjustments to our security controls based on such assessments to further enhance our security posture.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Our cybersecurity risk management program includes: • a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security department, including our CISO and experienced information systems security professionals and information security managers, divided into three teams: (1) security operations, which is responsible for responding to abuse on our platform, digital forensics and incident response, and threat intelligence; (2) security engineering, which is responsible for security data analysis and observability on our infrastructure and product offerings; and (3) trust and governance, which is responsible for privacy and security regulatory compliance and risk management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our Board of Directors (Board); • deployment of technical safeguards that are designed to protect our platform, customers, employees and systems from cybersecurity threats. We maintain cybersecurity insurance that provides coverage for cyber breaches, cyber-crime, and related matters; • the imposition of contractual obligations related to cybersecurity on our third-party vendors. In addition, we assess the security profile of those vendors that store, process or have access to sensitive data through questionnaires and data flow risk assessments; • securing data going to third-party vendors and, depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including through the use of monitoring tools, threat intelligence tools, and data protection tools. We actively monitor, manage and configure our systems to protect our data against any vulnerabilities we find; • continuous monitoring of our infrastructure network for vulnerabilities and threats through our security observability platform; • a system to proactively identify risks that may threaten customer information and utilize both internal and external resources to perform a variety of vulnerability and penetration testing on the platforms, systems and applications used to provide our products and services; • engagement of third party experts to assist in assessing, managing and reviewing various risks from cybersecurity threats and incidents, including to perform independent audits our data centers, to conduct adversary simulations and to perform network penetration tests periodically; • mandatory periodic cybersecurity awareness training for all of our employees and consultants, covering key threats and measures to take to protect their own data and the data of the company in addition to role-specific training for security personnel; and • a robust privacy practice governing information we collect from customers and how we use, share and store such customer data and implementation of measures to collect personal data only to the extent necessary to service our customers and to protect customer content data through limited access.


text: Our cybersecurity risk management program is designed to be adaptable in order to respond to an evolving landscape of emerging threats and available technology. Our security controls and cybersecurity risk management program are evaluated through data gathering and analysis of emerging threats from internal and external incidents and technology investments. See the Part I, Item 1A. "Risk Factors" for a more comprehensive description of risks related to cybersecurity.


text: Cybersecurity Governance Our Board has overall oversight responsibility for our risk management and delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee on a regular basis and briefing the full Board on cybersecurity risk oversight activities and preparedness efforts on an annual basis, as well as on an ad hoc basis upon request. Our Security teams have a wealth of cross-industry, government, and national defense experience. We employ qualified and certified security practitioners with specialized skill sets in security engineering, incident response, forensics, and threat management. Our CISO has more than a decade leading highly technical security teams that evolve with the technology and threat landscape.


text: Our security and legal teams oversee our information security and privacy practices and are responsible for identifying and proactively addressing security and privacy risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and incident response plans and maintaining cybersecurity programs. We maintain an in depth incident response plan that includes a process for identifying, containing and removing any threats and vulnerabilities and a plan to recover and restore normal business operations following an incident. Members of the security team are always on call to be able to address any issues that arise. In addition, we have created a cybersecurity materiality assessment team, which includes representatives from our security, legal, internal audit, communications and investor relations departments that reviews and assesses the impact of cybersecurity incidents on the company, our customers and other stakeholders. Our material assessment framework provides for an escalation path for any potentially material cybersecurity incidents from the security team to our CISO who may further escalate to the materiality assessment team, senior management and the Audit Committee. To ensure our preparedness to appropriately respond to cybersecurity incidents, the cross-functional team meets regularly and conducts simulations of cybersecurity incidents to test its procedures.


text: Our executive and senior management teams, including our chief executive officer, chief financial officer and CISO, supervise these efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents and the risk assessments and disclosure required if cybersecurity incidents do arise, through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is designed to be adaptable in order to respond to an evolving landscape of emerging threats and available technology. Our security controls and cybersecurity risk management program are evaluated through data gathering and analysis of emerging threats from internal and external incidents and technology investments. See Part I, Item 1A. "Risk Factors" for a more comprehensive description of risks related to cybersecurity.


text: Our security and legal teams oversee our information security and privacy practices and are responsible for identifying and proactively addressing security and privacy risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and incident response plans and maintaining cybersecurity programs. We maintain an in depth incident response plan that includes a process for identifying, containing and removing any threats and vulnerabilities and a plan to recover and restore normal business operations following an incident. Members of the security team are always on call to be able to address any issues that arise. In addition, we have created a cybersecurity materiality assessment team, which includes representatives from our security, legal, finance, internal audit, communications and investor relations departments that reviews and assesses the impact of cybersecurity incidents on the company, our customers and other stakeholders. Our material assessment framework provides for an escalation path for any potentially material cybersecurity incidents from the security team to our CISO who may further escalate to the materiality assessment team, senior management and the Audit Committee. To ensure our preparedness to appropriately respond to cybersecurity incidents, the cross-functional team meets regularly and conducts simulations of cybersecurity incidents to test its procedures.


text: Cybersecurity Risk Management As part of our overall enterprise risk management program, we maintain a robust cybersecurity risk management program. The cross-functional group responsible for the cybersecurity risk management program includes members of our information security, data privacy and product security personnel, including members of our senior management team. Our cybersecurity program provides a foundation for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and overall risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing the relevant members of our senior management team, which informs the Audit Committee and our Board of Directors of material cybersecurity threats and incidents.

companyName: SentinelOne, Inc.

ticker: S


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.


text: A cross-functional incident response team, comprised of representatives from information security, information technology, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.


text: In fiscal 2024, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors has oversight responsibility for our overall enterprise risk management, and cybersecurity risk management in particular is regularly reviewed and overseen by our Audit Committee. The Audit Committee provides oversight and reviews management policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed. Management regularly reports to the Audit Committee regarding its process and procedures to mitigate or remediate cybersecurity risks, threats and incidents, along with monitoring activities of the cybersecurity team.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who is a member of our executive management team and closely coordinates as needed with other senior management personnel including the Deputy Chief Information Security Officer, the Chief Product and Technology Officer and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Our team has established a continuous improvement process through which we regularly update our risk register against the evolving capabilities of adversaries and incorporate findings from internal and external testing. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.


text: In fiscal 2025, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Audit Committee provides oversight of our cybersecurity program and receives quarterly cybersecurity updates from our Chief Information Security Officer (CISO) through written reports and presentations. Our CISO has over 20 years of experience in cybersecurity, and has held senior leadership positions at publicly traded companies in the technology industry, bringing extensive expertise in managing cybersecurity risks. The CISO's leadership team consists of seasoned information security professionals with experience at globally recognized organizations, ensuring a robust and comprehensive approach to cybersecurity oversight.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CISO, who is a member of our executive management team and closely coordinates as needed with other senior management personnel including the President of Product, Technology, and Operations and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Interim CEO/Chief Financial Officer, to manage the risk assessment and mitigation process.


text: Our Interim Chief Executive/Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Interim Chief Executive/Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Interim Chief Executive/Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Our Cybersecurity Program, which we are aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans which are updated and exercised annually. Our cyber defenses are reviewed annually by third-party penetration testers using the Adversarial Tactics, Techniques and Common Knowledge ("MITRE ATT&CK") framework and the incident response is reviewed by experienced counsel. We incorporate cybersecurity risk reviews of third-party service providers within our Enterprise Third Party Risk Management Program. We conduct annual Cyber Risk Assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies and are provided formal cybersecurity training. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.

companyName: OneMain Holdings, Inc.

ticker: OMF


text: The Chief Information Security Officer ("CISO"), the Chief Technology Officer ("CTO"), and General Counsel are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CISO reports to the General Counsel and is responsible for implementing and maintaining our enterprise cybersecurity organization. Our CISO has served in both the private and public sectors developing extensive experience in cybersecurity operations, incident response, strategy, governance and compliance. The CISO provides periodic reports to our management risk committee on the mitigation of cybersecurity risks. The General Counsel provides executive oversight of the Cybersecurity Program, providing governance of cybersecurity capabilities and coordinating cybersecurity matters with senior management and the Board of Directors. Our experienced General Counsel has significant risk management, governance, litigation and regulatory experience. We believe these skills are needed in leadership of our Cybersecurity Program to ensure that risk management, legal, regulatory, disclosure and governance perspectives are considered in the design of our Cybersecurity Program and in evaluating and responding to potential cyber incidents. The CTO provides our Cybersecurity Program with the technical and functional resources to achieve its strategic goals and objectives. Our CTO has 30 years of experience with reliability and security of core systems, expertise important for establishing robust protocols and implementing best practices to safeguard against cyber threats and mitigate risks effectively. The General Counsel, CISO, and CTO meet regularly to evaluate the Company's Cybersecurity Program.


text: The Board is responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls. The CISO has regular and direct communication with the Board, providing a cybersecurity report to the Board's Risk Committee on a quarterly basis (more frequently as events warrant), as well as a written cybersecurity report and briefing to the full Board on an annual basis, in order to inform directors of the state of the Company's Cybersecurity Program. These reports cover, but are not limited to, the Company's cybersecurity posture, overall status of the Company's compliance with the Cybersecurity Program, threat environment, material cybersecurity risks and events, Cybersecurity Program improvements and effectiveness, and other material matters related to the Cybersecurity Program.


text: Our Cybersecurity Program, which we are aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans which are updated and exercised annually. Our cyber defenses are reviewed annually by third-party penetration testers using the Adversarial Tactics, Techniques and Common Knowledge ("MITRE ATT&CK") framework and the incident response plan is reviewed by experienced counsel. We incorporate cybersecurity risk reviews of third-party service providers within our Enterprise Third Party Risk Management Program. We conduct annual Cyber Risk Assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies and are provided formal cybersecurity training. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.


text: The secure collection, maintenance, processing and transmission of financial and operational data, ordering, point-of-sale processing and payment information, including personal data, is critical to our operations and the experience of our customers. We have implemented technologies and tools to evaluate our cybersecurity measures and maintain a cyber-risk management strategy related to our technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.

companyName: Aramark

ticker: ARMK


text: Risk Identification We employ a risk-based approach for our cybersecurity program in which the level of controls are based upon asset value and organizational risk. Consequently, our cybersecurity program has a layered approach to cyber controls focused on protection of the confidentiality, integrity, and availability of sensitive data (both internal and third party). Our CISO and cybersecurity organization are actively engaged within the cybersecurity threat intelligence community in order to monitor emerging trends and developments, attack vectors, and best practices for identifying and mitigating cyber threats.


text: Our cybersecurity team monitors the cyber risk climate on an ongoing basis and performs cyber risk assessments at both tactical and strategic levels that are integrated into our overall risk management processes. These risk assessments may review various issues such as Payment Card Industry Data Security Standard compliance and cyber vulnerability on an enterprise and application level.


text: We have a global information security program responsible for creating cybersecurity policies, including an overarching Global Information Security Policy, that takes in account the National Institute of Standards & Technology Cybersecurity Framework ("NIST CSF") and regulatory requirements. Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of our layered cybersecurity measures, which include a documented security architecture program, endpoint detection, security incident response and event management and recovery, and privileged access management, among others.


text: Likewise, logical access controls are employed to manage and provision access based upon business need, and data encryption is leveraged to preserve data confidentiality. Data is regularly backed up in support of preserving availability. Audit logs are collected, correlated and analyzed by the Security Operations Center ("SOC").


text: We provide all salaried employees, including new hires, cybersecurity training courses that sensitize them to risks and threat actor tactics. We also provide specialized security and data privacy training for certain employees, such as those handling sensitive or protected health information. On a quarterly basis, our cybersecurity organization conducts simulated phishing exercises to test and educate employees on real-world threats.


text: We engage third-party service providers as part of our cyber risk mitigation efforts. We contractually require vendors with access to personal information to maintain sufficient cybersecurity and data privacy standards. As part of our PCI compliance program, we assess vendors with access to payment card data on an annual basis, and we review other critical vendors periodically and on an as-needed basis. We also maintain relations with local and federal law enforcement in connection with cybersecurity matters.


text: In fiscal 2024, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services.


text: We purchase insurance to mitigate the potential financial consequences of cybersecurity incidents. We regularly review our cyber insurance program, assessing our coverage and policy terms.


text: During the normal course of business, we have experienced and expect to continue to experience a range of cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity to the Audit Committee, which reviews and oversees our programs, policies, practices and safeguards relating to: information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and our cyberattack incident response and recovery plan. The Audit Committee receives regular reports from our Chief Information Officer (CIO) and CISO on, among other things, our cyber risks and threats, the status of measures to strengthen our cybersecurity systems, assessments of our Cybersecurity program, and our views of the emerging threat landscape. During fiscal 2024, substantially all of our directors attended the Audit Committee meetings in which the Committee received updates relating to cybersecurity.


text: Role of Management Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes. Our CISO also oversees the Cybersecurity Incident Response Team ("CSIRT"), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary. We utilize a security incident response framework that is led by our CISO and supported by the CSIRT with the goal of both ensuring timely notification to our management and the Audit Committee, or the Board of Directors as appropriate, and mitigation of cybersecurity incidents. Our CISO also sits on our Disclosure Committee.


text: Our CISO brings over twenty years of extensive cybersecurity expertise, encompassing pivotal roles from hands-on technical positions to leadership responsibilities in designing, building and executing multiple cybersecurity teams and programs. Our CISO's career spans global organizations across different industries as retail, software and technology, medical device manufacturing and cyber advisory and audit services. Our CISO holds the following certifications: Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISC) from the Information Systems Audit and Control Association, and is a Certified Cybersecurity Information Security Officer (C-CISO) by the International Council of E-Commerce Consultants.


text: We have a global information security program responsible for creating cybersecurity policies, including an overarching Global Information Security Policy, that takes into account the National Institute of Standards & Technology Cybersecurity Framework ("NIST CSF") and regulatory requirements. Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of our layered cybersecurity measures, which include a documented security architecture program, endpoint detection, security incident response and event management and recovery, and privileged access management, among others.


text: In fiscal 2025, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services.


text: Role of the Board Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity to the Audit Committee, which reviews and oversees our programs, policies, practices and safeguards relating to: information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and our cyberattack incident response and recovery plan. The Audit Committee receives regular reports from our Chief Information Officer (CIO) and CISO on, among other things, our cyber risks and threats, the status of measures to strengthen our cybersecurity systems, assessments of our Cybersecurity program, and our views of the emerging threat landscape. During fiscal 2025, substantially all of our directors attended the Audit Committee meetings in which the Committee received updates relating to cybersecurity.


text: Our CISO brings over twenty years of broad technology leadership experience focused in the domains of cybersecurity, software engineering, and enterprise architecture. With a career spanning global organizations across different industries, such as retail, food service, defense and financial software, our CISO holds the following certifications: Certified Information Security Manager (CISM) by the Information Systems Audit and Control Association, Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both by the International Information System Security Certification Consortium.


text: We rely on Hines, our Sponsor, for the implementation of cybersecurity policies, standards and practices. Hines' enterprise-wide cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. Hines has robust cybersecurity systems and policies in place and generally approaches cybersecurity threats through a cross-functional, multilayered approach, which is described below.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Risk Management and Strategy The Hines cybersecurity program focuses on the following areas: • Vigilance: Hines' cybersecurity threat operations function around the clock to identify, prevent and mitigate cybersecurity threats and respond to any incidents timely. • Systems Safeguards: Hines deploys systems safeguards that are designed to protect our information systems from cybersecurity threats, including email filtering, website filtering, virus protection, disk drive encryption, multi-factor authentication, mobile device management, and robust network equipment, which are evaluated and improved through ongoing penetration tests and both internal and external audits. • Collaboration: Hines utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. These collaborative efforts include relationships with security operation center service and brand protection providers as well as cloud-based backup service providers. • Third-Party Risk Management: Hines utilizes a risk-based approach to cybersecurity risks presented by third parties, including the systems of third parties that could adversely impact our business. • Training: Hines provides periodic training for personnel regarding cybersecurity threats, such as cybersecurity awareness videos and phishing campaigns. Such training is adjusted to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Communication: Hines has formed an incident response team to address potential cybersecurity incidents. This team is composed of management personnel from Hines' technology, operations, legal, risk management, internal audit and other key business functions and is responsible for informing Hines' leadership, as necessary. The team also includes at least one of our officers to ensure that decisions regarding the disclosure and reporting of such incidents can be made by us in a timely manner, including communicating to our Board, if applicable.


text: Our Board oversees the implementation of Hines' cybersecurity risk management program and receives periodic reports from Hines' Chief Technology Officer (CTO) and Chief Information Security Officer ("CISO") regarding the effectiveness of Hines' cybersecurity risk management program. Additionally, our Board will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Hines' CISO and CTO are principally responsible for overseeing the cybersecurity risk management program, in partnership with other Hines leaders. The CISO has more than 30 years' experience in the IT industry, with over 20 years spent working with cybersecurity design and implementation, as well as infrastructure, audit, design, operation, and as the head of Hines' IT security and compliance practice. The CTO previously served as both Director and Vice President of Information Technology at Hines and has led several Hines technology implementations and strategic developments of proprietary applications and infrastructure.


text: There have been no material cybersecurity threats or incidents nor are we aware of any cybersecurity risks reasonably likely to affect us, our business strategy, results of operations, or financial condition. However, future cybersecurity incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Hines cybersecurity program focuses on the following areas: • Vigilance: Hines' cybersecurity threat operations function around the clock to identify, prevent and mitigate cybersecurity threats and respond to any incidents timely. • Systems Safeguards: Hines deploys systems safeguards that are designed to protect our information systems from cybersecurity threats, including email filtering, website filtering, virus protection, disk drive encryption, multi-factor authentication, mobile device management, and robust network equipment, which are evaluated and improved through ongoing penetration tests and both internal and external audits. • Collaboration: Hines utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. These collaborative efforts include relationships with security operation center service and brand protection providers as well as cloud-based backup service providers. • Third-Party Risk Management: Hines utilizes a risk-based approach to cybersecurity risks presented by third parties, including the systems of third parties that could adversely impact our business. • Training: Hines provides periodic training for personnel regarding cybersecurity threats, such as cybersecurity awareness videos and phishing campaigns. Such training is adjusted to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Communication: Hines has formed an incident response team to address potential cybersecurity incidents. This team is composed of management personnel from Hines' technology, operations, legal, risk management, internal audit and other key business functions and is responsible for informing Hines' leadership, as necessary. The team also includes at least one of our officers to ensure that decisions regarding the disclosure and reporting of such incidents can be made by us in a timely manner, including communicating to our board of directors, if applicable.


text: Our board of directors oversees the implementation of Hines' cybersecurity risk management program and receives periodic reports from Hines' Chief Technology Officer (the "CTO") and Chief Information Security Officer (the "CISO") regarding the effectiveness of Hines' cybersecurity risk management program. Additionally, our board of directors will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Hines' CISO and CTO are principally responsible for overseeing the cybersecurity risk management program, in partnership with other Hines leaders. The CISO has more than 30 years of experience in the IT industry, with over 20 years spent working with cybersecurity design and implementation, as well as infrastructure, audit, design, operation, and as the head of Hines' IT security and compliance practice. The CTO previously served as both Director and Vice President of Information Technology at Hines and has led several Hines technology implementations and strategic developments of proprietary applications and infrastructure.


text: There have been no material cybersecurity threats or incidents nor are we aware of any cybersecurity risks reasonably likely to affect us, our business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K. However, future cybersecurity incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: RISK MANAGEMENT AND STRATEGY Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. While management is responsible for day-to-day risk management, the Board, is responsible for the Company's overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The Audit Committee supports the Board in overseeing the overall framework for the risk assessment and enterprise risk management ("ERM") process for the Company. The Nominating & Governance Committee ("NGC") supports the Board by overseeing cybersecurity risks, policies and objectives. As part of its duties, the NGC regularly provides reports to the full Board of Directors (which includes Audit Committee members) related to matters within its responsibility. As a result of this process, the Audit Committee receives updates on, among other things, cybersecurity, which can be used to assist the Board and Audit Committee in its oversight of the Company's ERM processes.

companyName: PERRIGO Co plc

ticker: PRGO


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working independently but as part of a cohesive strategy to minimize risk, including the following: • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and ensure associates are educated and prepared to address shared cybersecurity risks. • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies. • Our global cybersecurity program increasingly leverages intelligence-sharing capabilities about emerging threats within the Consumer Packaged Goods sector, across other industries, with specialized vendors, industry groups, and through public-private partnerships with government intelligence agencies. Such intelligence allows us to better detect and work to prevent emerging cybersecurity threats before they materialize. • The Company's cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. • Our strategy to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through auditing, penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program.


text: We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.


text: The NGC, comprised solely of independent directors, is charged with oversight of risks related to global cybersecurity and operational resiliency. The NGC routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends and regulatory developments from the Chief Financial Officer ("CFO") and Senior Vice President, Information Technology and Services ("IT&S") Strategy and Business Partnering. The NGC meets separately in advance of each regular Board meeting and when needed in the event of a specific cybersecurity threat, and its Chair regularly reports out to the Board on key matters considered by the NGC. The Board is periodically briefed on related cybersecurity matters from other executives from Legal, Privacy, and IT&S, as well as external experts related to breach management, external attestation of the company's cybersecurity practices and processes, and evolving cybersecurity matters that may inform the company's cybersecurity strategy and approach. The Board has received and will continue to receive cybersecurity training.


text: Our overall information security efforts are led by the CFO and Senior Information Technology Executives. These leaders have substantial experience in cybersecurity including knowledge, skills, certifications, and background in cybersecurity.


text: We have a formalized breach management protocol that utilizes a cross-functional team to address global cybersecurity efforts that includes partnership with Legal, Risk, our CFO, IT&S Strategy and Business Partnering and Enterprise HR which lead matters when they occur. This collaborative approach, working with a wide range of key stakeholders to manage risk, allows us to effectively share and respond to threat intelligence. In the event of a specific cybersecurity threat or incident, management is notified in accordance with established escalation procedures. If appropriate, management then notifies the NGC, which may meet to describe the cybersecurity threat or incident before reporting out to the Board regarding the matter. We use forensic and other key third party service providers to assist the Company with its response in the event of a cybersecurity incident.


text: RISK MANAGEMENT AND STRATEGY Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board of Directors and management. We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. While management is responsible for the day to day risk management, the Board of Directors, is responsible for the Company's overall risk oversight function, including cybersecurity risks. The Nominating & Governance Committee ("NGC") supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. The Audit Committee supports the Board of Directors in overseeing the framework for risk assessments and enterprise risk management ("ERM") process. The Company's cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology ("NIST") frameworks for cybersecurity and privacy.


text: Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working as part of a cohesive strategy to minimize risk including the following: • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • Perrigo leverages the NIST cybersecurity framework to measure the capability of its cybersecurity program and we conduct third party assessments to measure the NIST ratings. • We maintain a cybersecurity risk register which is reviewed periodically with relevant stakeholders. Risks that are higher in impact are included within our Enterprise Risk Register which is reviewed with Executive Leadership and the Board of Directors. • Our processes used to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program. • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and educate associates on cybersecurity risks. • We maintain cyber insurance coverage to help mitigate possible costs associated with a potential incident. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies.


text: We have processes in place designed to allow us to oversee and identify risks from cybersecurity threats associated with our use of third party service providers and suppliers through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and security rating platforms. We also include cybersecurity and information security language in our contracts where applicable. We require our suppliers and partners to report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties. We have established processes to contain the impact of potential security incidents on Perrigo's third party service providers.


text: As of December 31, 2024, we are unaware of any risks from cybersecurity threats (including previous cybersecurity incidents) that may have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.


text: Our overall information security efforts are led by the Chief Information Security Officer ("CISO"). The CISO has substantial experience in cybersecurity, including knowledge, skills, certifications, and background in the field. The CISO holds several key certifications including Certified Information Systems Security Professional ("CISSP"), Certified Secure Software Lifecycle Professional ("CSSLP") and Certified Ethical Hacker ("CeH").


text: While management is responsible for day-to-day risk management, the Board of Directors is responsible for the Company's overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The NGC, comprised solely of independent directors, supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. As a part of its duties, the NGC regularly provides reports to the full Board of Directors.


text: The NGC routinely engages with the Chief Financial Officer ("CFO"), the CISO and Senior Vice President on a range of cybersecurity-related topics, including threats to the environment and vulnerability assessments, policies and practices, technology trends and regulatory developments. The NGC conducts regular committee meetings prior to each regular Board of Directors meeting and convenes additional sessions as necessary to address a specific cybersecurity threat.


text: Perrigo has an incident response team comprised of the CISO and senior leadership from Legal, Human Resources and Finance. We have a formalized breach management protocol and playbooks that are tested periodically. Perrigo uses a panel of forensic and third party service providers to assist the Company with its response in the event of a cybersecurity incident. We employ escalation procedures designed to notify management of certain specific cybersecurity threats or incidents. If deemed appropriate, management will notify the NGC, which may convene to discuss the cybersecurity threat before reporting to the Board of Directors on the matter.


text: Risk Management and Strategy We have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Zoom Communications, Inc.

ticker: ZM


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s). The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").


text: Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments; conducting our own security assessments, and imposing contractual obligations related to information security.


text: For a description of the risks from cybersecurity threats that may materially affect us, see "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously also served as Zoom's Chief Counsel to the COO and CISO.


text: The CISO provides regular briefings to our senior management and the Cybersecurity Risk Committee concerning relevant cybersecurity risks and the processes we have implemented to address them. The Cybersecurity Risk Committee and the Board also receive various reports, summaries, and presentations related to cybersecurity threats, risks, and mitigations.


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented certain technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide us with a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s), all as appropriate depending on the nature of the incident. The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments, conducting our own security assessments, and imposing contractual obligations related to information security.


text: As of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the risk factor titled "Our security measures, and those of the third parties with whom we work, have been compromised in the past and may be compromised in the future. If our security measures are compromised in the future or if our information technology fails, this could harm our reputation, expose us to significant fines and liability, impair our sales, and harm our business. In addition, our products and services may be perceived as not being secure. This perception may result in customers and users curtailing or ceasing their use of our products, us incurring significant liabilities, and our business being harmed" in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously served as Zoom's Chief Counsel to the COO and CISO.


text: Cybersecurity Governance Hilton has a dedicated Global Information Security team (collectively, the "GIS team") led by our Chief Information Security Officer ("CISO") that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The GIS team is organized into five functional areas: (i) cloud, network and infrastructure architecture security; (ii) application security; (iii) incident response; (iv) endpoint security and vulnerability management; and (v) governance, risk and compliance ("GRC"). Collectively, the GIS team has decades of dedicated cybersecurity experience with personnel certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: While the full board of directors has overall responsibility for risk oversight, for cyber security matters, it is supported by its Audit Committee, which regularly reports to the full board of directors. The Audit Committee assists the board of directors in monitoring cybersecurity risk by receiving quarterly reports and as needed updates from the Chief Information Officer and the CISO, that cover, among other things, our information security framework, threat assessment, response readiness and training efforts.


text: Hilton has adopted a Cybersecurity Policy that requires all employees to immediately report a potential cybersecurity incident to the GIS team, and all employees are required to certify their understanding of the Cybersecurity Policy on an annual basis. Our Global Cybersecurity Incident Response Plan ("CIRP") includes the criteria for determining if a cybersecurity incident is considered a qualifying cybersecurity incident ("QCI"), which requires management escalation and review, identifies the first response team and the leadership team responsible for supervising the response and provides guidelines for when and how to communicate such incident to the appropriate members of management and the Audit Committee.


text: Cybersecurity Strategy and Risk Management The GIS team leverages several mechanisms to continuously identify and assess cybersecurity risks across the Company and utilizes a GRC platform to monitor identified risks and mitigation and remediation activities. The GIS team uses defined industry accepted risk management and controls frameworks to determine the potential likelihood and impact of each risk. Monitoring activities are designed and executed based on the materiality of the assessed likelihood and magnitude of impact of the risks that are identified. The GIS team, with the assistance of third-party consultants, performs application security reviews, penetration tests and gap assessments against certain cybersecurity frameworks. Management reviews any assessments performed by the third-party consultants and determines the final evaluations and communication plan, which the GIS team executes.


text: In the event of a reported potential cybersecurity incident, a first response team, which includes leaders of the GIS team, other members of management and the legal team, determines without undue delay whether it is a QCI as defined in the CIRP. If an incident is determined to be a QCI, the process included in the CIRP is initiated and such incident is communicated to the designated leadership team, including Hilton's general counsel. Further, appointed leaders collaborate on determining if the incident is material, as well as the resulting response, including any legal and financial reporting obligations of the Company. Information also is provided to additional members of senior management as appropriate. The remediation plan for the QCI is entered within Hilton's GRC platform and monitored and reviewed at least monthly to ensure effective implementation; depending upon the type of incident, additional reporting may be produced and monitored by the GIS team to ensure the effectiveness of the remediation plan. All cybersecurity incidents are tracked within our incident response platform, regardless of the potential materiality of the impact.


text: We also have a process in place to manage cybersecurity risks associated with third-party service providers. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under "Part I—Item 1A. Risk Factors," specifically the risks titled "Failures in, material damage to or interruptions in our information technology systems, software or websites, including as a result of cyber-attacks on our systems or systems operated by third parties that provide operational and technical services to us, costs associated with protecting the integrity and security of personal data and other sensitive information and difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations" and "Cyber-attacks could have a disruptive effect on our business," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Risk Management and Strategy As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.

companyName: Knowles Corp

ticker: KN


text: Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.


text: We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.


text: To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Vice President of Information Technology on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.


text: Our management team, led by our Vice President of Information Technology ("VP of IT"), has operational responsibility for our cybersecurity and information security framework and risk management. Our VP of IT has extensive cybersecurity knowledge and skills gained from over 20 years of experience in leading and managing global IT operations and security teams. In addition, our VP of IT has a Master of Science degree in Management of Information Systems from Rensselaer Polytechnic Institute. Our VP of IT is supported by a team of enterprise information system and security risk professionals. The VP of IT receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Administrative Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our VP of IT supervises any retained external cybersecurity consultants.


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Chief Information Officer on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.


text: Our management team, led by our Vice President and Chief Information Officer ("CIO"), has operational responsibility for our cybersecurity and information security framework and risk management. Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 31 years, including serving as the Chief Information Officer at two large public companies. Our CIO is supported by a team of enterprise information system and security risk professionals. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Transformation Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our CIO supervises any retained external cybersecurity consultants.


text: We commit significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other information or operations technology assets. Our cybersecurity efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or otherwise cause damage.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors at least quarterly regarding cybersecurity and other information and operations technology risks.


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.


text: Risk Management and Strategy The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. In the event a cybersecurity incident occurs, we maintain cybersecurity insurance to provide appropriate resources for both financial and cyber expertise. We have partnerships for penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as National Institute of Standards and Technology (NIST) standards, and Cybersecurity and Infrastructure Security Agency (CISA) best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we utilize cyber ratings, prepared by reputable external agencies which provide an independent ranking of our cybersecurity maturity and coverage, to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies reviewed annually by the Board of Directors. We have also implemented certain third-party risk management processes to vet, select, and monitor suppliers.


text: Furthermore, we have established an organizational unit within the legal and compliance department that provides independent compliance testing and review for our regulatory obligations, industry standards, and policies and procedures. It supports the IT and cybersecurity department by conducting formal assessments of compliance measures, consulting on control development and enhancement, and facilitating third-party assessments.


text: Response In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.


text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we require our employees to complete recurring cybersecurity awareness training that provides immediate feedback and, if necessary, additional training or remedial action to employees.


text: We have experienced no material cybersecurity breaches. As such, we have not spent any material amount of capital on addressing impacts during this time, nor have we incurred any material breach expenses from penalties and settlements. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors regarding cybersecurity and other information and operations technology risks.


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for physical security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Senior Vice President and Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, human resources, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.


text: Risk Management and Strategy The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for vulnerability testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.


text: Further, cybersecurity risk has also been incorporated into the Company's enterprise risk management process such that cybersecurity risk is managed on a comprehensive basis as part of strategy setting and driving performance throughout the Company, which includes identifying, aggregating, monitoring, measuring, assessing and managing risks that could affect our ability to fulfill our business objectives or execute our corporate strategy.


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as those from the National Institute of Standards and Technology (, Department of Energy and Cybersecurity and Infrastructure Security Agency best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we leverage cyber ratings, developed by reputable independent agencies, to assess our capabilities and compare to our peers. We have also implemented certain third-party risk management processes to assess, select, and monitor suppliers.


text: Response In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. The response procedures are also designed to escalate information regarding cyber incidents promptly so that decisions regarding any required public disclosures and reporting can be made in a timely manner.


text: Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.


text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we provide our employees cybersecurity awareness training on a regular basis as well as regular security -focused announcements and seminars. We augment these educational trainings with live phishing exercises that simulate the current threat landscape. These exercises provide immediate feedback and, if necessary, additional training or remedial action. The Company also includes cybersecurity training as part of the on-boarding process of every employee.


text: Risk Management and Strategy NewtekOne maintains an enterprise-wide risk-management ("ERM") framework to identify, measure, mitigate, monitor and report material risks to NewtekOne. Our ERM process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Board. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:


text: 1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass internal systems, networks, applications, and data repositories, as well as external threats and vulnerabilities within the broader digital ecosystem.


text: 2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures to mitigate them.


text: 3.Risk Prioritization: Following the assessment phase, we prioritize identified risks based on their potential impact on our operations, data integrity, confidentiality, and reputation. This risk-based approach allows us to allocate resources effectively and focus on addressing the most significant threats first.


text: 4.Mitigation Strategies: We develop and implement robust mitigation strategies tailored to address specific cybersecurity risks. These strategies may include the deployment of technical controls, such as firewalls, intrusion detection systems, and encryption protocols, as well as the implementation of policies, procedures, and employee training programs to promote cybersecurity awareness and adherence to best practices.