text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through routine vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain an incident response plan designed to address our response to a cybersecurity incident, and a business continuity and disaster recovery plan. We conduct annual tabletop exercises to test these plans. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, as well as to communicate our evolving information security policies, standards, processes, and practices.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee of the Board, or the Audit Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: CareDx, Inc.

ticker: CDNA

secItem: Item 1C


text: The Board, in coordination with the Audit Committee, oversees our risk management program, including the management of cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds. Annually, the Board and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Chief Information Security Officer/Chief Information Officer, or CISO/CIO, and other senior management members.


text: The CISO/CIO, in coordination with senior management including the Office of the Chief Executive Officer, or the CEO, Chief Financial Officer, and General Counsel, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams have been established to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO/CIO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the Audit Committee when appropriate.


text: The CISO/CIO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Security Officer of another public company for over 6 years. The CISO/CIO holds undergraduate and graduate degrees in computer science and has attained the professional certification of Certified Chief Information Security Officer. Our CEO, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields. Collectively, they have several decades of experience managing risk at our company and in similar organizations or settings and assessing cybersecurity threats.


text: Material Affects of Cybersecurity Incidents Except as described in the section entitled "Risk Factors" included in Part I, Item 1A, including, without limitation, the risk factor above titled "We face four primary risks relative to protecting critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of our being unable to identify and audit our controls over the first three risks. In addition, an application, data security or network incident may allow unauthorized access to our systems or data or our customers' data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results" risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. In this instance, materiality is defined as an adverse impact to our critical information, which could result in significant legal and financial exposure.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit and Finance Committee of the Board, or the Audit and Finance Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit and Finance Committee, oversees our risk management program, including the management of cybersecurity threats. The Board and the Audit and Finance Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit and Finance Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds. Annually, the Board and the Audit and Finance Committee discuss our approach to overseeing cybersecurity threats with our Chief Technology Officer, or CTO, and other senior management members.


text: The CTO, in coordination with senior management including the Chief Executive Officer, Chief Financial Officer, and General Counsel, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams have been established to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the Audit and Finance Committee when appropriate.


text: The CTO has served in various roles in information technology and information security for over 25 years. The CTO holds undergraduate and graduate degrees in Management Information Systems and Masters in Business Administration. Our Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields. Collectively, they have several decades of experience managing risk at our company and in similar organizations or settings and assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Except as described in the section entitled "Risk Factors" included in Part I, Item 1A, including, without limitation, the risk factor above titled "We face four primary risks relative to protecting critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of our being unable to identify and audit our controls over the first three risks. In addition, an application, data security or network incident may allow unauthorized access to our systems or data or our customers' data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results" risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. In this instance, materiality is defined as an adverse impact to our critical information, which could result in significant legal and financial exposure.


text: Risk Management & Strategy Cybersecurity is integrated into the Company's overall risk management program. The Company has established a cyber risk management program that identifies and manages risks to our information assets that could be affected by a cyberattack. The Company leverages both internal and external threat detection and response capabilities, combined with a people-centric approach to employee awareness and engagement. The Company considers risks related to people, processes, and technology including those associated with our third-party service providers and allocates resources to maintain and enhance our cybersecurity measures.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: The Company engages external third-party security assessment vendors, both on a recurring basis and as needed, to perform realistic adversarial threat attacks (penetration testing) on our internal and external environments leveraging the International Organization for Standardization (ISO) cybersecurity frameworks. These third-party experts provide impartial, objective, and strategic evaluations of our cybersecurity posture, identifying critical vulnerabilities and recommending improvements.


text: Although, through the date of this filing, we are not aware of any cybersecurity incidents that have materially impacted the Company, we cannot eliminate all risks from cybersecurity threats. We describe whether and how risks related to cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Company senior leadership has top-level responsibility for management of information security risk. The Company has established a dedicated, globally focused cybersecurity team led by its Chief Information Security Officer (CISO), who brings over 20 years of experience in the field of cybersecurity and IT operations. The CISO is responsible for overseeing the entire global cybersecurity program, which encompasses cyber risk management, operations, strategic planning, and compliance with cybersecurity policies and regulations. Crown's cybersecurity team maintains collaboration with other cross functional teams to assess and manage cybersecurity risks. This approach enables the Company to align cybersecurity efforts with broader business objectives and respond to emerging threats. Additionally, Crown's Board of Directors, along with the Crown Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and General Counsel oversee the identification, assessment, and management of cybersecurity risks.


text: In case of a cyber incident with significant or material impact, the CISO would escalate to senior leadership and depending upon the severity and scope of any cyber incident, the Company will invoke its Corporate Crisis management plan.


text: On a regular reporting schedule, the CISO provides updates on cybersecurity risk and mitigation efforts to senior leadership, board, and members of the Audit Committee. The Audit Committee, which is tasked with oversight of certain risk issues, including information security risk, receives two to four reports annually from the Company's senior leadership, including the CISO, that includes an information security dashboard and discussion of emerging risks and trends. The Audit Committee then briefs the Board on these matters. Crown Holdings, Inc.


text: Our information technology ("IT") systems are critically important to our existing business operations and growth strategy. We provide services to individuals and others that require us to collect, process, maintain and retain sensitive and personal client confidential information in our IT systems, including patient identifiable health information, financial information and other personal information about our customers and end-users, such as names, addresses, phone numbers, email addresses, identification numbers, sensitive health data, and payment account information. As a result, we are subject to complex and evolving United States privacy laws and regulations, including those pertaining to the handling of personal data, such as HIPAA and CCPA. In addition to protecting the privacy of all health-related information for our members, our IT infrastructure supports the operations of all aspects of our business and ensures that we are able to continue to serve our members' transportation, personal care, and remote monitoring needs and execute our strategy to better connect people with care.

companyName: ModivCare Inc

ticker: MODVQ


text: The Company's Enterprise Risk Management Team (the "ERM Team") works in collaboration with the Company's Information Security Team to set the enterprise risk strategy and make risk-informed decisions, which include the assessment and response to cybersecurity risk. The Company maintains an information security, technology, and cybersecurity risk management program overseen by the Chief Information Security Officer (the "CISO") that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of its information. The Company's information security, technology, and cybersecurity risk management program provides the structure for managing the respective risks utilizing a combination of automated tools, documented processes, and third-party assessments to identify and assess potential cybersecurity risks. The Company engages third parties in connection with its cybersecurity program. Third party monitoring activities include the use of Security Information Event Monitoring ("SIEM") software and regularly scheduled vulnerability assessments performed by an independent third-party to capture and identify vulnerabilities, security events, and potential incidents. The Company also maintains a formal information security training program that includes training on matters such as phishing and email security best practices as well as data privacy which is required for all employees on an annual basis.


text: While processes are in place to minimize the chance of a successful cyberattack, the Company has established incident response policies and procedures to address a cyber threat that may occur despite these safeguards. In these instances, the Company maintains a cybersecurity incident response policy (the "Incident Response Policy") and cybersecurity incident response plan (the "Incident Response Plan") to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Incident Response Plan includes (1) detection, (2) analysis, which may include timely notice to the Audit Committee of our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. The Incident Response Plan includes leveraging the Company's cross-functional Cybersecurity Incident Committee that is supported by an organizational structure that includes executives across the Information Security, ERM, Finance, Legal, and Investor Relations functions of the business. The Cybersecurity Incident Committee is responsible for assessing the materiality of any cybersecurity incidents and for communicating any such incidents to the appropriate parties outside the Company.


text: The Company relies on our IT systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented processes to manage the cybersecurity risks associated with its use of third-party service providers, including processes during the contract review phase by both Information Security and Legal teams providing contractual safeguards as well as ongoing monitoring of third-party service providers for incidents that may affect the Company. To date, no cybersecurity incidents have had such a material adverse effect on us, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us.


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, compromise personally identifiable information regarding customers or employees, delay our ability to provide critical services to our customers, and/or jeopardize the security of our facilities. We continuously seek to maintain a robust program of information security and controls, but the impact of a material information technology event could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows. Governance.


text: Board's Roles and Responsibilities The Audit Committee is responsible for overseeing and monitoring the Company's information security, technology, and cybersecurity program and other IT and data privacy risks, controls, strategies, and procedures. The Audit Committee is comprised of board members with expertise in the areas of risk management, finance and technology, enabling them to effectively oversee such cybersecurity and other IT and data privacy risks. The Audit Committee receives updates from management as needed or at least quarterly which cover the Company's current cybersecurity and other IT and data privacy risk assessments and key risk areas. The Audit Committee also reviews and discusses with management, at least quarterly, and as needed, any material or significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Audit Committee receives regular updates on cybersecurity trends and emerging threats from the Information Security Team led by the CISO.


text: Management's Roles and Responsibilities In collaboration with the ERM team and the Audit Committee, the Company's Information Security Team, overseen by the CISO, is responsible for assessing and managing cybersecurity risks including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The Information Security Team is comprised of various IT groups with the knowledge and expertise needed to execute the technical aspect of the Incident Response Plan. This team is led by the CISO and other technical leaders with significant experience in the information security field. The CISO has over 18 years of experience serving as a CISO and in other security leadership positions in the information security and cybersecurity fields, including roles as VP of Information Security, Director of Infrastructure, Director of Information Security, and Manager of Information Security. In addition to his work experience, the CISO holds a certification as a Certified Information System Security Professional (CISSP). The CISO works closely with other management positions, including the Chief Accounting Officer, Chief Information Officer, Chief Audit Officer, Deputy General Counsel, and VP of Investor Relations through the Cybersecurity Incident Committee in order to ensure that the Company has effective communication and understanding of its cybersecurity risk management.


text: The processes by which the Information Security Team and CISO monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents include regular vulnerability assessments and penetration testing, security incident and event management, continuous monitoring, and threat and intelligence gathering. The CISO reports to the Audit Committee on a quarterly basis, and as needed, to provide an overview of our cybersecurity risk posture, the effectiveness of our cybersecurity policies, procedures, and strategies, and any material or significant cybersecurity incidents that have occurred or are likely to occur.


text: Our information technology ("IT") systems are critically important to our existing business operations and growth strategy. We provide services to individuals and others that require us to collect, process, maintain and retain sensitive and personal client confidential information in our IT systems, including protected health information ("PHI"), personally identifiable information ("PII"), financial information and other personal information about our customers and end-users, such as names, addresses, phone numbers, email addresses, identification numbers, sensitive health data, and payment account information. As a result, we are subject to complex and evolving United States privacy laws and regulations, including those pertaining to the handling of personal data, such as HIPAA and CCPA. In addition to protecting the privacy of all health-related information for our members, our IT infrastructure supports the operations of all aspects of our business and ensures that we are able to continue to serve our members' transportation, personal care, and monitoring needs and execute our strategy to better connect people with care.


text: The Company's Enterprise Risk Management Team (the "ERM Team"), led by Internal Audit, works in collaboration with the Company's Information Security Team to set the enterprise risk strategy and make risk-informed decisions, which include the assessment and response to cybersecurity risk. The Company maintains an information security, technology, and cybersecurity risk management program overseen by the Chief Information Security Officer (the "CISO") that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of its information. Controls over security, confidentiality, integrity, and availability are tested by external audit agencies, resulting in the Company's HITRUST, ISO 27007/27701, SOC2, and HIPAA certifications. The Company's information security, technology, and cybersecurity risk management program provides the structure for managing the respective risks utilizing a combination of automated tools, documented processes, and third-party assessments to identify and assess potential cybersecurity risks.


text: As part of the risk program, third parties engaged by the Company are subject to initial and continuous security monitoring activities including the use of Security Information Event Monitoring ("SIEM") software and regularly scheduled vulnerability assessments performed by an independent third-party to capture and identify vulnerabilities, security events, and potential incidents. The Company also maintains a formal information security training program that includes training on matters such as phishing and email security best practices as well as data privacy which is required for all employees on an annual basis.


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, compromise PHI or PII regarding customers or employees, delay our ability to provide critical services to our customers, and/or jeopardize the security of our facilities. We continuously seek to maintain a robust program of information security and controls, but the impact of a material information technology event could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows. Governance.


text: Management's Roles and Responsibilities In collaboration with the ERM team and the Audit Committee, the Company's Information Security Team, overseen by the CISO, is responsible for assessing and managing cybersecurity risks including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The Information Security Team is comprised of various Technology groups with the knowledge and expertise needed to execute the technical aspect of the Incident Response Plan. This team is led by the CISO and other technical leaders with significant experience in the information security field. The CISO has over 19 years of experience serving as a CISO and in other security leadership positions in the information security and cybersecurity fields, including roles as VP of Enterprise Technology, VP of Information Security, Director of Infrastructure and Cybersecurity, Director of Information Security, and Manager of Information Security. In addition to his work experience, the CISO holds a certification as a Certified Information System Security Professional (CISSP). The CISO works closely with other management positions, including the Chief Accounting Officer, Chief Information Officer, Chief Audit Officer, General Counsel, and VP of Investor Relations through the Cybersecurity Incident Committee in order to ensure that the Company has effective communication and understanding of its cybersecurity risk management.


text: Leadership and Governance Our organization is guided by our Chief Information Security Officer (CISO) who leads our enterprise-wide cybersecurity strategy, compliance, policy, standards, architecture, cyber operations, risk management, governance, and processes. With over 25 years of experience in Information Security, including 14 years as a CISO for several multi-billion-dollar organizations, our CISO brings unparalleled expertise to our security initiatives.

companyName: CONNS INC


text: Executive Reporting Our CISO provides periodic security and risk management updates to executive leadership, the board of directors, and audit committee, ensuring comprehensive awareness and oversight of our security posture. Updates are delivered during quarterly meetings with executive leadership and bi-annual meetings with the audit committee. Topics related to cybersecurity risk, control maturity, incident management, compliance posture, and security improvement initiatives are addressed during these meetings.


text: Standards and Frameworks Our cybersecurity program aligns with leading industry standards, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The NIST CSF provides a structured and flexible approach to managing cybersecurity risk, enabling us to effectively identify, protect, detect, respond to, and recover from cyber threats. By adhering to NIST standards, we enhance our resilience and ensure alignment with recognized best practices.


text: Thought Leadership and Collaboration We leverage thought leadership from key vendors, business partners, and industry intelligence sources to stay abreast of emerging threats and align with best practices. This collaborative approach enables us to proactively respond to evolving cyber risks while effectively managing risk in line with our organizational risk appetite.


text: Continuous Monitoring and Response Our security operations include 24/7 monitoring conducted by a third-party provider in collaboration with internal teams. Conn's has implemented vendor management controls that ensure our service providers practice due diligence and due care when providing professional services to Conn's or managing our data. Additionally, Conn's has implemented risk management processes to monitor for cybersecurity threats associated with vendors who have access to our systems, applications, or data. This proactive approach ensures timely detection and response to cybersecurity threats, minimizing the potential impact on our business operations and financial condition.


text: Incident Management As of the date of this Annual Report on Form 10-K, there are no known security threats or incidents that are likely to materially affect our business strategy, operations, or financial condition. We maintain robust incident management processes to swiftly address any security incidents that may arise, mitigating their impact and preserving the integrity of our operations.


text: In conclusion, our information security program is underpinned by strong leadership, adherence to industry standards, proactive monitoring, and collaboration with internal and external stakeholders. By prioritizing cybersecurity and risk management, we uphold our commitment to safeguarding our assets, maintaining operational resilience, and protecting the interests of our stockholders.


text: Risk Management and Strategy The Company's cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with all applicable laws and regulations and uses guidance from many best practices. Our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology's Cybersecurity Framework.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: We have established and continue to enhance our procedures for identifying cybersecurity risks and implementing defenses to mitigate these risks. We devote significant resources to maintaining and regularly updating our systems and processes to protect the security of our computer systems, software, networks and other technology assets against unauthorized parties attempting to access confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our cyber incident response plan provides procedures and controls for timely and accurate reporting of any material cybersecurity incident, and each associate is educated, trained and tested on cybersecurity to help be our first line of defense.


text: We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO"). In addition, our Security Operations Center provides near-real-time monitoring of network traffic going in and out of the enterprise to identify any abnormalities or indications of malicious behavior. We use managed security services providers to provide monitoring, threat hunting and response services through network and security log monitoring and a hosted security information and event management solution.


text: We conduct regular enterprise-wide internal and external cyber risk assessments. These efforts include audits, internal and external regulatory compliance assessments, and periodic self-assessments. Vulnerability assessments are performed frequently for systems, and internal and external penetration tests are performed annually. We periodically engage vendors to review and benchmark our cybersecurity processes. In addition, members of the CST perform regular security control assurance testing.


text: Our internal audit department also reviews our cybersecurity program, processes, policies and controls at least annually. The program also is regularly reviewed in annual external audits and regulatory assessments. Lessons learned from those efforts are used to drive improvements to continually strengthen the cybersecurity program, including controls for data security.


text: The CST works closely with the sourcing and vendor management team when contracting for third-party information technology services. Our information technology architecture review board, which includes cybersecurity leadership, reviews all potential vendors. We have comprehensive cybersecurity assessment processes and procedures in place, including security risk questionnaires, standard documentation requests, and utilization of a third-party risk evaluation tool to provide insight on potential third-party vendors. We utilize private connections (including private VPN) and extensive use of virtual desktops to secure access to our data and systems. Our legal team ensures that specific protections are included in contracts, including confidentiality language, nondisclosure obligations and security provisions.


text: Critical vendors are monitored by our sourcing and vendor management team. Resources contracted through a third-party that will have access to corporate systems must complete CNO's associate training or their company's security awareness training that has been approved by CNO. We also perform periodic risk assessments throughout the term of the engagements, including those third parties located outside the United States that have access to our Company and customer information.


text: To date, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology and data security.


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 23 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident.


text: Risk Management and Strategy The Company's cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses, which is integrated into the Company's overall risk management processes. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with applicable laws and regulations and is based on many industry best practices. For instance, our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology's Cybersecurity Framework.


text: As of December 31, 2024, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology.


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 24 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – General Business Risk – "Interruption in telecommunication, information technology and other operational systems, or a failure to maintain the security, confidentiality or privacy of sensitive data residing on such systems, could harm our business," and "The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase the operational risks discussed above, or create new or unanticipated operational risks."


text: Risk Assessment and Management As digitization and technological advancements continue to accelerate, the landscape of cybersecurity faces new challenges. Compass Minerals remains vigilant in our efforts to minimize risk by safeguarding systems and protecting private business, partner, and customer information. Protection of our digital assets requires strategically focused cybersecurity processes with persistent execution.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, and/or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical, and/or physical controls and employee training, education, and awareness initiatives.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response services for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We separately operate an ERM program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition, and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: Incident Response We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an incident response team ("IRT") that works in conjunction our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification, and call center service(s). Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider. We have independent validation and assessment capabilities from our cyber insurance provider (Resilience). Each year we select several third-party suppliers for evaluation, analyze resultant reports, and mitigate risks associated with the vendor as needed.


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures. COMPASS MINERALS INTERNATIONAL, INC.


text: Our board level audit committee retains oversight of our cyber security program, which is led by our vice president of information technology services. Our senior leadership regularly provides updates on cybersecurity risks and cyber security initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: The Audit Committee. The Audit Committee reviews with our management team, including our vice president of information technology services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our vice president of information technology services, who reports to our Chief Strategy Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program. COMPASS MINERALS INTERNATIONAL, INC.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Furthermore, our cybersecurity program is periodically reviewed by senior management members and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.


text: Incident Response We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an Incident Response Team ("IRT") that works in conjunction with our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from the incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based on the potential impact, likelihood, velocity, and vulnerability of risks, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technological initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures.


text: Our board-level audit committee retains oversight of our cybersecurity program, which is led by our Vice President of Information Technology Services. Our senior leadership regularly provides updates on cybersecurity risks and cybersecurity initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of executive management, and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as significant related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: The Audit Committee. The Audit Committee reviews with our management team, including our Vice President of Information Technology Services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and associated risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Vice President of Information Technology Services, who reports to our Chief Financial Officer, and brings more than 15 years of leadership experience in enterprise technology, digital transformation, and operational risk management. This position oversees the Company's information technology, cybersecurity, data governance, and enterprise architecture functions and has led multi-year modernization initiatives across infrastructure, core business platforms, and security tooling. The Vice President of Information Technology Services has experience managing cybersecurity frameworks, vulnerability management programs, OT/IT security integration, vendor risk oversight, and incident response preparedness, in addition to a background in leading cross-functional teams, partnering with external security firms, and strengthening organizational controls to reduce cyber, operational, and compliance risks. The Vice President of Information Technology Services holds both a masters degree and a bachelors degree in business administration. Prior to working at Compass Minerals, the Vice President of Information Technology Services held various positions of increasing responsibility within the IT function, including Business Solutions Architect; Manager, Business Solutions; and Director, Business Solutions. The IT Department's security team, led by our Senior Manager, Cybersecurity, comprise of a cross-functional group of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required. COMPASS MINERALS INTERNATIONAL, INC.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are continually evolving, becoming increasingly complex and pervasive across all industries. To mitigate these cybersecurity risks and protect nonpublic, personally identifiable customer data, financial transactions and our classified information systems, the Bank has implemented a comprehensive information security program, which is a component of its overarching enterprise risk management program. Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Annual security assessments that proactively identify potential vulnerabilities that are both externally facing and internal within the bank's infrastructure; reports the results for all assessments to executive management and the Board of Directors with tracking and resolution to potential areas of risk. • Vulnerability management program that patches known vulnerabilities across operating systems and software platforms. • Strong controls around user access including creation, changes and termination of access, ongoing user access reviews, multifactor authentication and password policies. • A technology team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Adoption and implementation of a layered defense / defense in depth model n which security systems are linked or stacked so that the strengths of one security system compensate the weaknesses of the other system. • Additional controls that include but not limited to data encryption; change management; end of life management; asset management; malware and antivirus detection, response and mitigation; physical security; business continuity and disaster recovery management.

companyName: BCB BANCORP INC

ticker: BCBP


text: The Bank engages reputable third-party assessors to conduct various independent audits on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Bank leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: The Bank's Third-Party / Vendor Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's information security program and strategy are designed to ensure the Bank's information and information systems are resilient and appropriately protected from a variety of threats, both natural and man-made. Periodic audits and risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls and policies are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank information. These controls and policies include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Bank's information security program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Bank's business, financial condition, and results of operations, the Bank does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Bank, including its business strategy, results of operations or financial condition. Accordingly, no matter how well designed or implemented the Bank's controls are, there is a risk that it may not be able to anticipate all zero-day cyber security exploits and vulnerabilities, and it may not be able to implement effective preventive measures against such exploits / vulnerabilities and potentially associated security breaches in a timely manner.


text: Board of Directors Oversight The Bank's Board of Directors is charged with overseeing the establishment and execution of the Bank's security management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Bank's security management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Information Technology /Information Security Committee of the Board of Directors. The Information Technology /Information Security Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Technology Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The Information Technology department is responsible for implementing and maintaining the Bank's cybersecurity risk management program. The Information Technology department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by Chief Information Technology Officer, who reports directly to the Chief Operating Officer and dotted lined to the Board of Directors. The Bank's CITO has over 23 years of experience in technology and cybersecurity across the financial services industry. Prior to joining the Bank, the Bank's CITO served as Chief Information Officer and Information Security Officer at First Choice Bank and the Director of Technology and IT Governance at OceanFirst Bank. The Information Technology department is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the Information Technology Department through quarterly management reporting to achieve an appropriate flow of information risk reporting to the Board. The committees and working groups that monitor information security risks include the Cybersecurity Incident Response Team, and the Information Technology / Information Security Committee of the Board of Directors. These committees and working groups establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Management's Role We recognize the critical importance of developing, implementing, assessing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Senior Management, in collaboration with the Information Technology and Risk Departments, is responsible for the implementation and oversight of the Bank's Cybersecurity Risk Management Program.


text: Information security risk is systematically reported to our Board of Directors by the Information Technology and Risk Departments through quarterly management reports, ensuring a structured and effective flow of cybersecurity risk information to the Board of Directors. Various committees and working groups are dedicated to monitoring and managing information security risks, including the Cybersecurity Incident Response Team and the Information Technology/Information Security Committee of the Board of Directors. These committees play a pivotal role in establishing and overseeing policies, programs, and guidance that define clear expectations for managing cybersecurity risk.


text: Due to the evolving nature of cybersecurity threats, we actively engage with external experts to enhance our security expertise. These subject matter experts provide independent evaluations and testing of our cybersecurity risk management framework. Our collaboration with these entities includes regular audits, threat assessments, and consultations on security enhancements to reinforce our security posture.


text: As a trusted advisor to our clients and a regulated financial services firm, information and cybersecurity are critical to our operations and reputation. Our management team takes an active role in identifying, assessing, monitoring and managing material risks from information and cybersecurity threats. Management's assessment of information and cybersecurity threats is incorporated into our enterprise risk management processes, which include assessing inherent risks posed by the internal operating environment and external factors, assessing the adequacy and design of controls, testing controls, determining residual risk and comparing it to risk appetite thresholds, and taking steps to further mitigate risks as needed. Our board of directors is actively engaged in the oversight of cybersecurity and information technology risks, with primary oversight responsibility delegated to the audit committee of the board of directors. The audit committee is composed of board members with the appropriate expertise, including risk management, cybersecurity and finance, to oversee these risks as well as management's cybersecurity processes and protocols.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Our chief information and operations officer is a member of our leadership team and has been in this role for 15 years. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and our security controls are mapped to the NIST Cybersecurity Framework to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Additionally, we regularly engage consultants and other third parties to evaluate specific priority areas of our information and cybersecurity program based on our assessment of the current cybersecurity threat landscape. Examples of our engagement with consultants include external penetration testing, application security assessment and cybersecurity incident response tabletop exercises.


text: Our third-party vendor management program has a tiered approach to assess vendors based on risk profile. We review each third-party vendor's architectures, security practices and data flows, and integrate stringent contractual terms encompassing breach notifications and other security requirements. The risk profiles associated with our service level agreements are monitored by senior employees in our information security and technology departments. Our vendor management program also includes an annual reassessment of the risk profile of each vendor and interim vendor reviews are completed if service alterations occur.


text: Senior information security and technology employees, including the chief information and operations officer, meet regularly to discuss potential information and cybersecurity threats that have been identified by our systems, employees or otherwise made known to us by our third-party service providers, vendors and other external users, and to formulate the appropriate response to any identified material information and cybersecurity threats. When high-priority information or cybersecurity risks are identified, certain employees in our information security, privacy, technology, legal and compliance departments meet or communicate to review potential threats in accordance with our internal cybersecurity incident response process.


text: Potential threats, our response to such threats, and our evaluation of any residual risk are communicated quarterly to the audit committee. As necessary, the chief information and operations officer provides interim updates to the audit committee and, as appropriate, the board of directors, concerning high-priority or material information or cybersecurity threats. Our chief information and operations officer also provides a quarterly update to the audit committee regarding our ongoing information and cybersecurity initiatives; the current cybersecurity landscape and emerging threats; and metrics on the effectiveness of certain aspects of our information and cybersecurity program.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: We believe that we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, as well as controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. Additional information regarding risks related to cybersecurity is included under "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Our chief information and operations officer is a member of our leadership team and has been in this role since 2008. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, and our security controls are mapped to the NIST Cybersecurity Framework 2.0 to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework 2.0. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In 2024, our board of directors also participated in the cybersecurity incident response tabletop exercise. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: Risk management and strategy We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our Chief Information Security Officer, or CISO, and Chief Information Officer, or CIO, periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see "Significant disruptions of information technology systems or data security breaches could adversely affect our business" under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors, or Audit Committee, helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). Our CISO has been at the company for over 7 years, and has served in various cybersecurity roles for over 20 years across multiple companies and industry verticals including banking, consulting, ecommerce, and pharmaceuticals. He is a Certified Information Systems Security Professional and has experience responding to major information security incidents at previous companies prior to joining the company. Our CIO has been at the company and had oversight of our cybersecurity for over 7 years. In addition, our CIO has served in various information technology roles in the U.S. and overseas for over 25 years across multiple companies and industry verticals including consulting, healthcare, and pharmaceuticals. • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Risk Management and Strategy. The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Governance. Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy. The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.