text: Our information technology governance, including cybersecurity, is documented through written policies, procedures, guidelines, and standard operating procedures. All of our employees are required to undergo quarterly cybersecurity training. This training includes cybersecurity policies, cyber threats, and incorporating best practices into daily routines. Contractors and vendors that have access to our data, devices, or services are required to complete cybersecurity training prior to receiving access. Employees, vendors, and contractors with access to our operational technology network are required to undergo additional training specific to operational technology interactions. We maintain a Supplier Code of Conduct that is provided to our providers of materials and services during the onboarding process and that conveys our expectations regarding use and access requirements when using our technology resources.


text: We also manage cybersecurity risk through incident response strategies. We employ a fault-tolerant, highly available architecture and network segmentation as part of our containment strategy. We do not solely rely on architecture to ensure continuity and containment, and we employ additional technologies including, but not limited to, automated account disabling, automated device quarantining, network segment-isolation scripts, and cyber kill chain runbooks. We have implemented an Enterprise Data Backup Policy, which includes, among other activities, offsite backups, intra-day recovery points, and routine restoration of critical data. We use infrastructure-as-code to enable recovery of virtualized environments and employ data replication across multiple operating regions. We routinely exercise our recovery capabilities. Our Cybersecurity Incident Response Plan establishes a framework to manage the life cycle of a cyber event. Additionally, our Enterprise Crisis Management Plan provides a structure to assemble an enterprise crisis team in the event of a potential cyber related crisis. The crisis response team, including our Chief Information Officer (CIO), is responsible for managing the channels of communication pursuant to our Crisis Management Plan. This notification includes the notification or reporting of any significant cyber incidents to executive management. We periodically conduct cyber incident drills that include, as applicable, members of our Board of Directors, executives, certain business stakeholders, and legal and security partners, as necessary.

companyName: Midstream Co LLC

secItem: Item 1C


text: While we and third parties that provide services to us commit resources to the design, implementation and monitoring of our digital systems, there is no guarantee that our or our third parties' cybersecurity measures will provide absolute security. Like other companies in the natural gas industry, we have identified and expect to continue to identify cyberattacks and incidents on our systems. Additionally, we have received notification from third-party service providers of certain such matters on their systems. None of the cyberattacks and incidents we have identified, or been notified of, to the filing of this Annual Report on Form 10-K has had a material impact on our business strategy, results of operations or financial condition. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations, or financial condition, see "Cyberattacks aimed at us or those third parties on which we rely, as well as any noncompliance by us or such third parties with applicable laws and regulations governing cybersecurity and/or data privacy, could materially adversely affect us." included in Part I, "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Given the importance to us of our cybersecurity program, in April 2022, our Board elected to exercise direct oversight of cybersecurity matters, rather than acting through its committees. The Board, as well as separately our executive management, receives, and has the opportunity to ask questions and raise discussion points regarding, management reports from the CIO and Senior Director of Cybersecurity and Network Operations on cybersecurity matters, as needed and no less than quarterly throughout the year, which reports include items such as cybersecurity updates, cybersecurity operational results, and audit findings. In addition, the Board and executive management receives and reviews the results of our cybersecurity risk and capabilities assessment on an annual basis.


text: The cybersecurity program is managed by our CIO and our Senior Director of Cybersecurity and Network Operations and reviewed and monitored by executive management, with oversight from the Board. Our CIO has significant expertise and more than 30 years of experience in information technology and cybersecurity including cloud technologies and reports to our Executive Vice President & Chief Legal Officer. Our Senior Director of Cybersecurity and Network Operations has more than two decades of experience in the fields of information technology and cybersecurity and holds cybersecurity certifications, including the Certified Information Systems Security Professional, Certified Cloud Security Professional, and GIAC Information Security Professional certifications. The CIO and Senior Director of Cybersecurity and Network Operations meet regularly with each other and members of their team to discuss cybersecurity threats, capabilities and program strategy. We have built in incident workflows that automatically provide notifications and escalate cybersecurity incidents. During an incident, the CIO acts as the incident commander and the Senior Director of Cybersecurity and Network Operations acts as operations section chief, working together to provider supervision over incident response.


text: Cybersecurity Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identifty potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: We have not experienced a cybersecurity incident or identified risks from known cybersecurity threats or prior cybersecurity incidents that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "System failures or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities" in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incidend prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.


text: The Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.


text: Cybersecurity Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Information Technology Committee of our board of directors.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of the Information Security Officer's team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by the Informaiton Security Program, as well as the Information Technology Committee, with the goal of addressing changing threats and conditions.


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Information Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Cybersecurity Governance Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incident prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.


text: The Information Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Information Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Information Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Information Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and practices. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attack on, or use of, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored therein.

companyName: Bally's Corp

ticker: BALY


text: Our data breach management policy classifies potential threats by risk levels, and we typically prioritize our threat mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) and Privacy Information Management System (PIMS) which are certified as meeting the requirements of the ISO 27001 & ISO 27701 standards, respectively; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity and data privacy audits conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to any sensitive information and systems; and • Maintaining cyber liability insurance.


text: We also understand the importance of collecting, storing, using, sharing, and disposing of personal information in a manner that complies with all applicable laws. To facilitate compliance with those laws, we have privacy policies in place regarding our treatment of customer data in both our offline and online environments, as well as policies relating to the protection of employee and vendor data. Our policies provide explanations of the types of information we collect, the rationale for such collection, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A "Risk Factors -Cybersecurity and Technology Risks.


text: Cybersecurity and data protection falls under our overall risk management and oversight. Our Board of Directors periodically receives reports from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel regarding various types of risks faced by the Company and the Company's risk mitigation efforts related thereto, including cybersecurity risks and related mitigation efforts.


text: The Board also receives presentations from management regarding trends in cybersecurity risks and risk mitigation initiatives and plans, including briefings on recent breaches at other companies and key takeaways and lessons learned that are applicable to our business. The Board will also periodically review key cybersecurity-related benchmarks for the Company.


text: The Company has a dedicated Security Forum and a Data Protection Committee comprising members from our senior leadership that convene on a regular basis to receive updates from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel about the Cybersecurity & Privacy programs we have in place; discuss and assess material risks and planned risk mitigation, incidents and planned remediation efforts, trends observed, consider cybersecurity-related proposals, and review and adopt changes in cybersecurity policies.


text: Management's Responsibilities In the event we identify a potential cybersecurity or data privacy issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity and data privacy initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity, each in consultation with professional advisors. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over ten years of experience in managing global data privacy programs. Our cybersecurity and data privacy management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity and data privacy risk detection, identification, assessment, classification, and mitigation efforts.


text: Our data breach management policy classifies potential incidents by risk levels, and we typically prioritize our incident mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate cyber security and risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) that is certified as meeting the requirements of the ISO 27001 standard; • Implementing a Privacy Information Management System (PIMS) that complies with the requirements of the ISO 27701 standard; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity evaluations conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to sensitive information and systems; and • Maintaining cyber liability insurance.


text: Management's Responsibilities In the event we identify a potential cybersecurity issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over 7 years of experience in managing global data privacy programs. Our cybersecurity management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity risk detection, identification, assessment, classification, and mitigation efforts.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidentiality of business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Technology Finance Corp.

ticker: OTF


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: We engage in an annual enterprise-wide risk assessment process which includes an evaluation of cybersecurity risks. We recognize the critical importance of securing the information of the Company's customers, vendors, and employees and maintaining the security of our systems and data and have developed a comprehensive cybersecurity incident response plan.

companyName: Amcor plc

ticker: AMCR


text: While everyone at the Company plays a part in managing cybersecurity risks, oversight responsibility is shared by the Board of Directors, the Audit Committee, and management. The full Board of Directors receives an annual information technology report and an update from management, which includes an update on our cybersecurity efforts. The Board of Directors has delegated to the Audit Committee the review of the quarterly cybersecurity reports from management, which outline our cybersecurity risk management framework and include updates on our completed, on-going, and planned actions relating to cybersecurity risks.


text: Our Chief Information Security Officer ("CISO") leads our global Security Operations Center and has over 20 years of experience in cybersecurity, including serving in similar roles at other public companies. Our CISO reports to our Vice President of Information Technology who has 28 years of experience in Manufacturing and Financial Services and has been leading our IT function for 14 years. Our Vice President of Information Technology reports to our Chief Financial Officer. Our employees supporting our information security program have relevant educational and industry experience.


text: Our Security Operations Center team members have extensive experience in deploying and operating cybersecurity technologies which is enhanced on an ongoing basis through interactions with third party experts we employ to help protect the Company from cybersecurity threats. In addition, we maintain a global cross functional cyber crisis team which is responsible for evaluating cybersecurity threats and overseeing compliance with regulatory security requirements.


text: Risk Management and Strategy We have implemented an extensive cybersecurity program that leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats while maintaining the confidentiality and availability of our information systems. We have adopted physical, technological, and administrative controls on data security, and have a defined procedure for data incident detection, containment, response, and remediation. We perform periodic assessments to identify and assess cybersecurity risks, including through the utilization of third parties to assess our system vulnerabilities. We also regularly train employees on cybersecurity risks, including through monthly phishing simulations.


text: We perform cybersecurity risk assessments of the third-party vendors we utilize and have processes to identify cybersecurity risks posed by using third-party systems. We also request our third-party vendors to promptly notify us of any actual or suspected breach that could impact our data or operations.


text: Our global footprint exposes us to numerous and evolving cybersecurity risks that could have an adverse effect on our business, financial condition, and results of operations. To date, we have not experienced any significant impacts from cybersecurity threats. However, our safeguards may not always be able to prevent a cyber-attack from impacting our systems or successfully execute our business recovery protocol, which could have a material impact on our business, financial condition, results of operations, or cash flows. Refer to the risk factor captioned "Cybersecurity Risk – The disruption of our operations or risk of loss of our sensitive business information could negatively impact our financial condition and results of operations" in "Item 1A. - Risk Factors" of this Annual Report on Form 10-K for additional narrative on our cybersecurity risks and the potential related impacts to us.


text: Our recent merger with Berry presents an opportunity to enhance and unify our cybersecurity risk programs by integrating the strengths of both legacy cybersecurity organizations. As part of this integration, we are conducting a comprehensive cybersecurity risk assessment, harmonizing cybersecurity policies, processes, operations, and consolidating the cybersecurity functions into a single organization. Our integration efforts will concentrate on maintaining the continuous availability of our operations while aligning our organization's risk management strategy.


text: Our Chief Information Security Officer ("CISO") has over 20 years of experience in cybersecurity, including serving in similar roles at other public companies. Our CISO leads a team that focuses on the Company's cybersecurity, including primary responsibility for leading enterprise-wide information security strategy, processes, as well as assessing, identifying, and managing cybersecurity risks. The team is enhanced through ongoing interactions with third party experts to help protect the Company from the latest cybersecurity threats. In addition, we maintain a global cross functional cyber crisis team which is responsible for evaluating cybersecurity threats and overseeing compliance with regulatory security requirements. Our CISO reports to our Vice President of Information Technology who has 29 years of experience in Manufacturing and Financial Services and has been leading our IT function for 15 years. Our Vice President of Information Technology reports to our Chief Financial Officer. Our employees supporting our information security program have relevant educational and industry experience.


text: Risk Management and Strategy We have implemented an extensive cybersecurity program that leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats while maintaining the confidentiality and availability of our information systems. We have also established and maintain a comprehensive Global Security Incident Response Plan designed to enable compliance with reporting standards and provide a robust response to global cybersecurity events. We perform periodic assessments to identify and assess cybersecurity risks, including through the utilization of third parties to assess our system vulnerabilities. We also regularly train employees on cybersecurity risks, including through monthly phishing simulations.


text: Our Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and intended to comply with applicable laws governing the use and protection of data, including HIPAA. In general, the Company seeks to address cybersecurity risks by focusing on preserving the confidentiality, integrity, and availability of the information that the Company collects and by aiming to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents when they occur.

companyName: AGILITI, INC. \DE


text: The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly engages with the Company's risk management function, the Company's Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and other members of management. • Collaborative Approach: The Company has implemented a wide-ranging approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains an incident response and recovery plan that addresses the Company's response to a cybersecurity incident, and such plan is tested and evaluated on a regular basis. • Third-Party Risk Management: The Company employs a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company's methods for managing third-party cybersecurity risk include reliance on contractual clauses, periodic due diligence, audits by third parties, and vulnerability testing. • Education and Awareness: The Company provides biannual training for personnel regarding information security, privacy, and compliance.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company endeavors to adjust its cybersecurity policies, standards, processes and practices based on the information provided by these assessments, audits and reviews.


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats in coordination with the Audit Committee and regularly discusses the approach to cybersecurity risk management with management, including the Company's CIO and CISO. The Board and the Audit Committee each receive quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and vendors. The Board and the Audit Committee also receive prompt and timely information regarding cybersecurity incidents that may meet company-established reporting thresholds, as well as ongoing updates regarding such incidents through resolution.


text: The Company's CISO, in coordination with our Chief Executive Officer, Chief Financial Officer, CIO, General Counsel and Chief Compliance Officer, works collaboratively across the Company to implement the Company's cybersecurity program, to protect the Company's information systems from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company relies on the expertise of its cybersecurity team to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the cybersecurity team and key security vendor partners, the CIO and CISO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.


text: The CIO has served in various roles in information technology for over 25 years, including serving as the Chief Information Officer and in a variety of senior technology roles at public companies. The CISO has served in various roles in information technology and information security for over 30 years, including previously serving as the Chief Information Security Officer of a large public company in the banking industry. In addition, the CISO held executive roles in information technology and cyber security development for the U.S. Department of Defense for over 20 years. The CISO holds a graduate degree in information and communication sciences and has attained the professional certification of Certified Information Systems Security Professional ("CISSP").


text: During the fiscal year ended December 31, 2023, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there is no guarantee that a future cybersecurity incident would not materially affect our business. For more information about the cybersecurity risks we face, see the risk factor entitled "Any failure of our management information systems, including as a result of a cybersecurity event or other system breach, could harm our business and operating results" under Item 1A., "Risk Factors" of this Form 10-K.


text: Risk Management and Strategy The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity standards, processes and practices, which are integrated into the Company's overall risk management processes. To protect the Company's information systems from cybersecurity threats, including those related to third-party service providers, the Company uses various security tools, such as third party vendors that help the Company identify, escalate, investigate, resolve and recover from security incidents in a timely manner. The Company's cybersecurity procedures and standards are reviewed and overseen by the Company's cybersecurity group.

companyName: New Fortress Energy Inc.

ticker: NFE


text: The cybersecurity group holds periodic meetings and reviews metrics it deems appropriate, including any incidents and threats, and the current state of cybersecurity issues and threats in the industry. These efforts include developing a threat model that assesses potential damage to the Company's business and the likelihood of threat. We test the risk prioritization rankings of our threat model with external data about breaches and incidents reported by governmental agencies, including the Cybersecurity and Infrastructure Security Agency and National Security Agency. The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes as needed.


text: For high priority incidents, the cybersecurity group will manage a risk-appropriate response, which may include the use of third-party vendors to support any investigation, response, and remediation efforts. Updates regarding any incidents are provided to management as appropriate.


text: During the year ended December 31, 2023, the Company is not aware of any cybersecurity incidents or threats that materially affected our business, results of operations or financial condition.


text: Management oversees the Company's risk management process, including cybersecurity risks, and receives updates regarding any cybersecurity incidents directly from the cybersecurity group as appropriate. The cybersecurity group is led by the Chief Technology Officer, who has over 15 years of experience in information security. Management will evaluate any cybersecurity risks, concerns and issues and determine whether to escalate such issues to the Board or any of its committees. Our Board is responsible for the oversight of management as well as the business and affairs of the Company. In carrying out this responsibility, the Board discusses and receives regular updates on a wide variety of matters affecting the Company.


text: Please see the risk factor captioned "Information technology failures and cyberattacks could affect us significantly" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which are overseen by a team of internal cybersecurity professionals, including individuals with over ten (10) years' experience handling vulnerability and security management, system upgrades, mitigation initiatives, user education and system re/accreditation. The Company provides regular desk-top educational training and incident simulation exercises to better address potential cyber security incidences and response thereto.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Cybersecurity threats are identified by the Incident Response Team ("Response Team") pursuant to the Cybersecurity Response Policy ("Cybersecurity Policy") and escalated to the Enterprise Risk Management Executive Committee ("ERM Committee") or member thereof pursuant to criteria set forth in this policy (See "Governance—Management" below for further discussion of the ERM Committee and the members of management comprising the ERM Committee). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.


text: The Company's Chief Digital and eCommerce Officer (CDEO) oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The CDEO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The experience of our Response Team includes cybersecurity incident response, in-depth security assessments and security evaluation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: The Company does not use any third-party consultants for assessment, management or identification of cyber security risks. The Response Team conducts regular internal testing of the Company's cyber security systems.


text: Board of Directors The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.


text: The Audit Committee is informed of material risks from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, the ERM Committee reports material risks from cybersecurity threats to the Company's Audit Committee and/or board of directors on a regular basis. The Company's Board of Directors has received training on cyber security and governance of the Company's processes for minimizing threats and response to incidences.


text: The Company's management, including members of its ERM Committee, the Response Team, and the Company's CDEO, assess and manage material risks from cybersecurity threats. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the ERM Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity risk management processes have been integrated into the Company's overall enterprise risk management processes.


text: The Chief Executive Officer, Chief Financial Officer, Chief Commercial Officer, Chief Operating Officer, and General Counsel comprise the Company's ERM Committee. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures.


text: The CDEO or a delegate thereof informs the ERM Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's Cybersecurity Policy and related processes. The CDEO regularly reports to the ERM Committee concerning material risks from cybersecurity threats to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which are overseen by a team of internal cybersecurity professionals, including individuals with over ten years' experience handling vulnerability and security management, system upgrades, mitigation initiatives, user education and system re/accreditation. The Company provides regular desk-top educational training and incident simulation exercises to better address potential cyber security incidences and response thereto.


text: The Company's Senior Director of IT ("SDIT") oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The SDIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The experience of the Company's Response Team includes cybersecurity incident response, in-depth security assessments and security evaluation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: The Company uses a third-party consultant for monitoring, management and identification of cyber security risks. The Response Team also conducts regular internal testing of the Company's cyber security systems.


text: The Company's management, including members of its ERM Committee, the Response Team, and the Company's SDIT, assess and manage material risks from cybersecurity threats. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the ERM Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity risk management processes have been integrated into the Company's overall enterprise risk management processes.


text: The Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, and General Counsel comprise the Company's ERM Committee. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures.


text: The SDIT or a delegate thereof informs the ERM Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's Cybersecurity Policy and related processes. The SDIT periodically reports to the ERM Committee concerning material risks from cybersecurity threats to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.


text: We have taken a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the IT Steering Committee (a task force comprised of senior representatives from all functional areas of the bank) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the IT Steering Committee's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. We have designed our enterprise-wide information security programs consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Meridian Corp

ticker: MRBK


text: The Corporation's Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Information Security Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings on an annual basis and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The IT Steering Committee and the full Board actively participate in discussions with management regarding cybersecurity risks. The IT Steering Committee performs an annual review of the Corporation's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The IT Steering Committee's annual review also includes review of recent enhancements to the Corporation's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Corporation is managing those threats. Further, at least annually, the Board receives updates on the Corporation's Incident Response Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents could have a material adverse effect on our business, financial condition or results of operations." in Item 1A- Risk Factors.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems, that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: AppLovin Corp

ticker: APP


text: We conduct periodic risk assessments to identify potential cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. The frequency of these risk assessments is based on the potential risk and criticality to our business systems. The risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential impact and damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate how to reasonably address identified gaps in existing safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high level personnel, including our Head of Information Security and Compliance, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies and educated about cybersecurity best practices through annual company-wide cybersecurity training, regular phishing simulations, and role-based training, as appropriate.


text: We engage consultants and third parties in connection with our risk assessment processes. These providers assist us in evaluating our cybersecurity program, provide support for threat monitoring and detection, and scan for vulnerabilities and other related security events which may pose a risk to the company.


text: We utilize our third-party risk management program to evaluate the cybersecurity posture of our third-party service providers based on risk, including data and systems access. These processes assist us in identifying and mitigating risks from cybersecurity threats associated with our use of third-party service providers. Where appropriate, we contractually require third-party service providers to implement and maintain appropriate and reasonable security measures in connection with their work with us and consistent with applicable laws, and to promptly report any breach of their security measures or systems that may affect our company.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company in the future, including our business strategy, results of operations, or financial condition, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Security breaches, improper access to or disclosure of our data or user data, other hacking and phishing attacks on our systems, or other cyber incidents could harm our reputation and adversely affect our business."


text: Our Head of Information Security and Compliance and the InfoSec team are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Head of Information Security and Compliance has over two decades of experience leading cybersecurity, data privacy and risk management programs for large, multi-national organizations and Fortune 500 companies, and CISSP and CRISC certifications. Our InfoSec management team is comprised of qualified cybersecurity professionals whose collective expertise includes penetration testing, cyber threat intelligence, data privacy, information security, and risk and compliance in the healthcare, financial, and technology industries, with certifications such as CISA, CRISC, CISSP, CCSP, CIPP, GIAC, and OSCP.


text: Our Head of Information Security and Compliance and the InfoSec Team, in partnership with our Legal Privacy Team, oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Head of Information Security and Compliance and the InfoSec Team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their implementation and oversight of safeguards, including through the use of automated tools and manual processes, like security event monitoring, vulnerability scanning, threat analytics, security awareness and training, endpoint security, bug bounty program, offensive security testing, and third-party risk and monitoring.


text: Our Head of Information Security and Compliance provides quarterly and as needed briefings to the Audit Committee regarding our company's cybersecurity program and information security risks, including any recent AppLovin-related cybersecurity incidents and possible responses, internal and third-party cybersecurity systems testing, third-party risk management, and other topics related to cybersecurity. The Audit Committee provides updates to the Board on such reports. The Company has adopted an escalation process for review of cybersecurity incidents, based on severity level, by an internal cyber task force with oversight by the Audit Committee. In addition, our Head of Information Security and Compliance provides annual briefings to the Board on our cybersecurity program and risks.


text: As part of our overall risk management system, we monitor and test our safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies and educated about cybersecurity best practices through annual company-wide cybersecurity training, regular phishing simulations and cybersecurity reminders, and role-based training, as appropriate.


text: Our cybersecurity risk management program is closely based upon recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and certain other applicable industry standards. In 2024, we obtained our ISO/IEC 27001 certification.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced cybersecurity incidents. For information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Security breaches, improper access to or disclosure of our data or user data, other hacking and phishing attacks on our systems, or other cyber incidents could harm our reputation and adversely affect our business."


text: Our Head of Information Security and Compliance and our InfoSec management team are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Head of Information Security and Compliance has over two decades of experience leading cybersecurity, data privacy and risk management programs for large, multi-national organizations and Fortune 500 companies, and CISSP and CRISC certifications. Our InfoSec management team is comprised of qualified cybersecurity professionals whose collective expertise includes penetration testing, cyber threat intelligence, data privacy, information security, and risk and compliance in the healthcare, financial, and technology industries, with certifications such as CISA, CRISC, CISSP, CCSP, CIPP, GIAC, and OSCP.


text: Our Head of Information Security and Compliance and our InfoSec management team, in partnership with our legal privacy team, oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Head of Information Security and Compliance and our InfoSec management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their implementation and oversight of safeguards, including through the use of automated tools and manual processes, like security event monitoring, vulnerability scanning, threat analytics, security awareness and training, endpoint security, bug bounty program, offensive security testing, and third-party risk and monitoring.


text: Risk Management and Strategy Rhinebeck Bank recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a financial services company, cyber threats are ever present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and the potential of cyber threats. Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council Cybersecurity Guidelines, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Managing Material Risks & Integrated Overall Risk Management Rhinebeck Bank has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our internal risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Rhinebeck Bank engages with a range of independent external data security professionals, including cybersecurity risk assessors, consultants, internal and external auditors, and insurance professionals to obtain a holistic view of our cybersecurity landscape. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultations on cybersecurity enhancements to proactively address new and evolving risks and strengthen our cyber security program.


text: Mitigating Third-Party Risk Because we are aware of the risks associated with third-party service providers, Rhinebeck Bank implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with strict cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.


text: Board of Directors Oversight The Board is responsible for the oversight of cybersecurity risk management and is composed of members with diverse expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.


text: Management's Role in Managing Risk The General Counsel and Chief Risk Officer ("CRO"), the SVP, Information Technology, the virtual Chief Information Security Officer ("vCISO") employed by DeepSeas Security, a cyber defense services business that partners with customers to reduce cybersecurity risks and the related costs. The vCISO and the CEO each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee at least once per year and more frequent as needed. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our regularly scheduled Board meetings, the General Counsel and CRO, the SVP, Information Technology, the vCISO and the CEO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Rhinebeck Bank. The Board of Directors closely reviews the annual vCISO report of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel The vCISO directly reports to the General Counsel and CRO. The vCISO, CRO and the SVP, Information Technology meet regularly to discuss both internal and external cybersecurity risks and incidents. The CRO and the SVP, Information Technology also regularly meet with the CEO to update him on any cybersecurity risks and incidents affecting us. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Rhinebeck Bank. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our vCISO at DeepSeas Security. With over 20 years of global leadership and management experience in the field of cybersecurity, our vCISO brings a wealth of expertise to his role. His experience includes prior CISO leadership roles in the fintech sector, where he developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our vCISO oversees our governance programs, works with our technology-focused leaders and partners to align security and compliance, and has helped define our employee security awareness training program.


text: Monitoring Cybersecurity Incidents The vCISO is informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The vCISO provides structure for clear processes to ensure the regular monitoring of our information systems. At Rhinebeck Bank, this includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our partnership with DeepSeas Security allows us to be equipped with a well-defined incident response plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: Risk Management and Strategy Rhinebeck Bank recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Cybersecurity risk management is an integral part of our overall enterprise risk management program. As a financial services company, cyber threats are ever present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and the potential of cyber threats. Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council Cybersecurity Guidelines, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. We continuously monitor evolving regulatory requirements related to cybersecurity and ensure that our cybersecurity program fully complies with all applicable laws and standards.


text: Managing Material Risks and Integrated Overall Risk Management Rhinebeck Bank has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our internal risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.


text: Mitigating Third-Party Risk Because we are aware of the risks associated with third-party service providers, Rhinebeck Bank implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers with access to Customer Non-Public Information before engagement and maintain ongoing monitoring to ensure compliance with strict cybersecurity standards.


text: Management's Role in Managing Risk The risk management function is led by the General Counsel and Chief Risk Officer ("CRO"), the SVP, Information Technology, the Information Security Officer, and the virtual Chief Information Security Officer ("vCISO") employed by DeepSeas Security, a cyber defense services business that partners with customers to reduce cybersecurity risks and the related costs. The vCISO and the CEO each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee at least once per year and more frequent as needed. These briefings encompass a broad range of topics, including: The current cybersecurity landscape and emerging threats; The status of ongoing cybersecurity initiatives and strategies; Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Vulnerability/patch reporting for end points on the Bank's network In addition to our regularly scheduled Board meetings, the General Counsel and CRO, the SVP, Information Technology, the vCISO and the CEO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Rhinebeck Bank. The Board of Directors closely reviews the annual vCISO report of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel The vCISO and the Information Security Officer directly report to the General Counsel and CRO. The vCISO, CRO, the SVP, Information Technology, and Information Security Officer meet regularly to discuss both internal and external cybersecurity risks and incidents. The CRO, the SVP, Information Technology and the Information Security Officer also regularly meet with the CEO to update him on any cybersecurity risks and incidents affecting us. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Rhinebeck Bank. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Dow contracts with external firms to assess Dow's cybersecurity controls relative to its peers using the NIST CSF. Dow also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: DOW INC.

ticker: DOW


text: Dow has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques.


text: Additionally, Dow engages in cyber crisis response simulations to assess Dow's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. Dow's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.


text: Dow also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate Dow's security posture. The Company also engages external firms to measure Dow's NIST CSF maturity level.


text: Role of Management Dow's Information Systems organization led by Dow's Chief Information and Digital Officer, is responsible for administration of the cybersecurity and information security framework and risk management, with oversight by the Audit Committee.


text: The Company's Chief Information and Digital Officer has formal education in information technology and extensive experience working in and leading Dow's information systems and technology function. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: The Company's management responsible for developing and executing Dow's cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant industry experience in security related industries. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: The Company's Cyber Security Operations Center ("CSOC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or Dow internal information systems and incidents originating from third parties. The CSOC provides end-to-end operations for purposes of monitoring, detecting, alerting and responding to cybersecurity incidents. The CSOC evaluates each incident in terms of its impact on the Company's operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. The CSOC is also responsible for activating the containment and resolution efforts and third-party service providers are engaged where appropriate to support the Company through the resolution of the incident. The CSOC escalates incidents with significant impact and pervasiveness to the Company's Corporate Crisis Management Team for further action. After initial identification, the CSOC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board Dow's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. The Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee of the Board. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders, including the Chief Information and Digital Officer and Chief Information Security Officer, with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with significant experience and/or expertise in technology or cybersecurity, including information systems.


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: As of the date of this report, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Although the Company has mature processes in place to identify and mitigate potential risks from cybersecurity threats, such risks cannot be completely eliminated. More information on the risks of cybersecurity threats and potential impact to the Company can be found in Item 1A. Risk Factors.


text: Role of Management Dow's Information Systems organization is led by Dow's Chief Information and Digital Officer, who reports to Dow's Chief Operating Officer, and is responsible for administration of the cybersecurity and information security framework and risk management, with oversight by the Audit Committee of the Board.


text: The Company's Chief Information and Digital Officer has formal education in information technology and more than 30 years of experience in information systems and technology, including as the vice president of Global Information Technology. Prior to joining Dow, the Chief Information and Digital Officer held a variety of leadership roles including vice president of Information Technology at Cargill, Incorporated. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: The Company's management responsible for developing and executing Dow's cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant experience in security related industries. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: Role of the Board Dow's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. While the full Board is accountable for cybersecurity and AI risk management, the Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee of the Board. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders, including the Chief Information and Digital Officer and Chief Information Security Officer, with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee also reviews external firms' assessments of the Company's security posture and NIST CSF maturity level. Information made available to the Audit Committee is also made available to the full Board. The Audit Committee includes members with significant experience and/or expertise in technology or cybersecurity, including information systems.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: BlackSky Technology Inc.

ticker: BKSY