text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance and Oversight The Company's Board of Directors has a mix of experiences, skills, qualifications and backgrounds to support strategy and risk oversight, including expertise in cybersecurity and oversight of cybersecurity matters. This oversight is achieved through the Company's Finance and Risk Management ("F&RM") Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity. The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, "Information Security"). At each regularly scheduled F&RM Committee meeting, management, through the Company's Chief Information Security Officer ("CISO"), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: HERSHEY CO

ticker: HSY

secItem: Item 1C


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact, that is aligned with the National Institute of Standards and Technology ("NIST"). This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer ("CIO"), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.


text: HP's work to defend against cybersecurity threats is occurring against the backdrop of an evolving global threat landscape. Like other Fortune 500 companies, we face a substantial number of cybersecurity threats—ranging from common cyberattacks such as phishing to more evolved threats that incorporate the use of AI. Our products and processes pose an attractive challenge for the most advanced of threat actors—including but not limited to those who are state-sponsored. As a global corporation with a wide range of systems and networks in place, and with customers who threat actors might also wish to target, we could face attacks not only on our own structures, but also on those of our many third-party providers and partners. In response to this threat environment, we have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our holistic approach is designed to integrate cybersecurity across the value chain, including in the design, development, and delivery of our products, services, solutions, and operations.

companyName: HP INC

ticker: HPQ


text: Our Chief Information Security Officer ("CISO") has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Our cybersecurity organization collaborates heavily with technology, business and legal stakeholders to enable secure business strategy, maintain, and grow proper security oversight, enhance security monitoring and response, and quantify and reduce risks and compliance gaps. There are six key focus areas within the cybersecurity organization: enterprise security operations, architecture and security engineering, identity access management, IT risk management and compliance, governance, risk and compliance, and strategy and program delivery. Additionally, we aim to incorporate a broad range of industry-standard cybersecurity best practices throughout our cybersecurity organization. These include, among other things: • an insider threat program that coordinates resources to discourage, identify, and mitigate cybersecurity threats; • regular audits of HP cybersecurity systems and annual risk assessments of related HP systems and processes, including our information security management systems; • an incident response plan that sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate; • annual and ongoing security awareness training for employees; • a cybersecurity/information security policy, as well as an acceptable use policy that defines the permitted usage of company-provided technology and contains consequences for noncompliance; • company-wide privacy policies as well as a physical security program that secures our offices and data center facilities; • systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use; and • engagement with industry peers and participation in cybersecurity forums to share knowledge and learn from best practices.


text: On an annual basis, the cybersecurity organization also enlists the aid of an independent third party to assess our alignment with the National Institute of Standards & Technology's Cyber Security Framework. The assessment examines our information/cybersecurity program and its associated controls and delivers a report that documents assessment results and provides recommendations for further enhancements. The cybersecurity organization is responsible for presenting an overview of the Cybersecurity Risk Assessment Report to the Board of Directors on at least an annual basis, and the HP executive leadership team is heavily involved in implementing and resolving recommendations. From time to time, we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Our cybersecurity risks are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors, and our Internal Audit function, which is an objective, independent assurance and advisory organization that helps HP achieve business objectives and conducts regular assessments, audits, and testing of the cybersecurity program and its associated controls.


text: As of the date of this Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that we will not experience such an event moving forward and if realized, these risks are reasonably likely to materially affect us. Additional information on cybersecurity risks we face can be found in "Risk Factors" in Item 1A of Part I of this report under the heading "System security risks, data protection breaches, cyberattacks, system outages and systems integration issues could disrupt our internal operations or services provided to customers, and could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price," which should be read in conjunction with the foregoing information.


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Board and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and Audit Committee regularly receive reports and presentations from management regarding our information and technology security program, including the CISO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 20 years of experience as a CISO at the Company and elsewhere, has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Risk Management and Strategy. Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.

companyName: HNI CORP

ticker: HNI


text: The cybersecurity team under the direction of the Corporation's Chief Information and Digital Officer ("CIDO"), is responsible for assessing, deploying, and managing the cybersecurity risk management program. Recognizing the complexity and evolving nature of cybersecurity threats, the cybersecurity team engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing the Corporation's risk management systems. The collaboration with these independent third-parties includes regular threat assessments, such as penetration tests and table-top exercises, and consultation on security enhancements. In addition, the cybersecurity team provides training to applicable members annually and ongoing cybersecurity education. Additionally, the Corporation maintains cyber risk insurance.


text: Depending on the products and services provided and the potential for data exchange and technology risk, suppliers and other third-party service providers are evaluated by the cybersecurity organization to assess their security and data protection capabilities. Additionally, security and data-focused contract provisions are incorporated where necessary in supplier and other service provider agreements to include industry-standard security and resiliency requirements that include timely reporting of cybersecurity incidents. The Corporation periodically reviews independent assessments of major service providers.


text: Governance. The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.


text: The Audit Committee is responsible for ensuring management has processes in place designed to identify and evaluate cybersecurity risks to which the Corporation is exposed and implement programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management under the CIDO is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential risk exposures are monitored, implementing appropriate mitigation measures and maintaining cybersecurity programs. The CIDO and cybersecurity team members are certified and/or experienced information systems security professionals and information security managers with many years of experience.


text: The CIDO receives reports from the cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Appropriate procedures for communication to the Audit Committee are also built into the incident response plan.


text: The CIDO regularly updates the Audit Committee and the full Board of Directors on the Corporation's cybersecurity risk management program, material cybersecurity risks, and mitigation strategies. Management provides the Audit Committee with quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Corporation's cybersecurity risk management program, developments in cybersecurity, and updates to the Company's cybersecurity risk management program and mitigation strategies.


text: Cybersecurity Threats. The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - STRATEGIC AND OPERATIONAL RISKS - The Corporation relies on information technology systems to manage numerous aspects of the business and a disruption or failure of these systems could adversely affect business, operating results, and financial condition." which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.


text: The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.


text: Cybersecurity Threats The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - Strategic and Operational Risks - The Corporation's information technology systems, processes, and sites may suffer interruptions, security incidents, or failures that may affects its ability to conduct its business and cause significant damage to its reputation." which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy As a global organization, the Company's information systems are subject to various risks, including, but not limited to risks associated with ransomware, system disruption, data theft, unauthorized access to information, and misuse of data. To identify, address, and mitigate these risks, the Company has developed and maintains a cybersecurity program. The Company's cybersecurity program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Company's Enterprise Risk Management (ERM) process and relies on internal and external expertise.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Integration with ERM Processes The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for overseeing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes a member of the ERM Executive Committee, helping to ensure timely analysis of disclosure obligations relating to cybersecurity events.


text: Cybersecurity Program Components The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of third parties to assess, test, validate, and strengthen the cybersecurity program, including penetration testing and the periodic use of a third party to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.


text: The Company's cybersecurity program also includes employee training and education. Frequent employee training topics include social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. Training emphasizes the importance of reporting incidents promptly to the Company's security operations team. The Company also conducts periodic phishing tests with employees and provides employees with easy-to-use tools to report potential phishing emails.


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. The Company's internal cybersecurity team is led by the Company's Director of Information Security and Compliance, who acts in the capacity of a chief information security officer and is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. The Director of Information Security and Compliance reports to the Company's Vice President of IT Services and has education, training, and experience pertinent to cybersecurity, including more than 25 years of IT experience with over 15 years in Information Security and holds the Certified Information Security Systems Professional (CISSP) certification.


text: Board of Directors The Company's Board of Directors (Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks, security breaches, or other IT interruptions, involving its own systems or those with whom it does business."


text: Integration with ERM Processes The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for managing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company periodically conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes members of the ERM Executive Committee, helping to ensure timely analysis of potential disclosure obligations relating to cybersecurity events.


text: Cybersecurity Program Components The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of internal resources and third parties to assess, test, validate, and strengthen the cybersecurity program, and the periodic use of third parties to perform penetration testing and to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.


text: Board of Directors The Company's Board of Directors ( Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks or other security breaches."


text: Risk Management and Strategy In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our members' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.

companyName: HUMANA INC

ticker: HUM


text: f. Engaging an independent third-party audit firm to perform an Annual Service Organizational Controls (SOC) 2 audit of enterprise claims platforms.


text: g. Reporting data breaches, as required by law, to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), and various state agencies; our reports are publicly available, free of charge, and can be obtained through the OCR Portal at https://ocrportal.hhs.gov/ocr/breach.


text: h. Maintaining a program to identify cybersecurity risks associated with certain third party vendors, which is one component of an overall vendor risk management program.


text: We also enhance our information technology infrastructure and security protocols to assess, identify, protect against, and manage material risks from cybersecurity threats following a risk-based approach. In addition, we conduct cybersecurity risk assessments at least annually, and periodically engage an independent auditor or other external assessors to aid in pro-active risk identification, prevention, detection, mitigation, and remediation. Our efforts to manage against cybersecurity threats are further guided by Federal and state laws, as well as contractual commitments with third parties, which regulate our collection, use and disclosure of confidential information such as protected health information and personally identifiable information.


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2023. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: As part of its overall responsibility for oversight of our enterprise risk management, our Board of Directors reviews material risks to our Company, including risks from cybersecurity threats. The Board has designated our Audit Committee and Technology Committee with joint oversight over our information technology internal controls, cybersecurity, business continuity and disaster recovery programs.


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, and evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive and industry leader in risk management practices in highly regulated fields. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.


text: Among our cybersecurity and risk teams, we utilize established governance mechanisms to enable a transparent and holistic approach to cybersecurity risk management, and the evaluation and remediation of cybersecurity incidents. These processes enable cross-functional engagement from our enterprise information protection, enterprise risk management, enterprise compliance, information technology, legal, privacy, and data governance teams.


text: As a key component of this governance framework, the Audit Committee and Technology Committee also receive regular updates regarding our cybersecurity program and cybersecurity incidents from our Chief Information Security Officer.


text: Risk Management and Strategy In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party with which we do business. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our customers' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.


text: h. Maintaining a program to identify cybersecurity risks associated with certain third-party vendors, which is one component of an overall vendor risk management program.


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2024. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive with more than two decades of experience leading technology teams in large, regulated industries. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.


text: Cyber Risk Management and Strategy EastGroup incorporates cybersecurity processes, which include periodic tests of its information security processes and systems by external firms, into the Company's overall risk management program. EastGroup has processes and policies regarding incident response, identity and access management, employee training on cybersecurity matters, device management, and patch and vulnerability management, among others. We also maintain processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including conducting phishing exercises with the Company's employees.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: Additionally, EastGroup has information technology general controls in place in support of internal control over financial reporting. These controls are tested by the Company's internal audit function and control deficiencies, if any, would be reported to senior management and the Audit Committee of the Board of Directors.


text: Governance Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.


text: The Company's Board of Directors oversees EastGroup's risk management process. Specifically, the Board of Directors has delegated to the Audit Committee, as reflected in the charter of the Audit Committee, responsibility for periodic review and oversight of the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee receives periodic updates from the Cyber Risk Committee regarding these topics. Both senior management, including members of the Cyber Risk Committee, and the Audit Committee Chairperson report periodically on cybersecurity risk management to the full Board of Directors. Additionally, management conducts comprehensive risk surveys annually and presents the results of these surveys to the Board of Directors for discussion.


text: Cyber Risk Management and Strategy Cybersecurity risk management policies and processes are integrated into EastGroup's enterprise risk management program. These policies and processes include incident response, identity and access management, employee training on cybersecurity matters, device management, patch management and vulnerability assessment. The Company also maintains processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including network penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including training for all employees. This training supports information security awareness and adherence to Company policies and guidance through regular, mandatory training and random simulated phishing tests.


text: As of the date of this report, the Company has not identified breaches from any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to affect operations, business strategy or financial condition. For additional information regarding our cybersecurity risks, see "Item 1A. Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or cyber-attack of that technology could harm our business."


text: Governance Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has over 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.


text: Risk Management and Strategy The Company utilizes information systems to support a variety of business processes and activities in its decentralized operations. These systems may be subject to cyber-based attacks or breaches. For additional information related to the risks associated with cybersecurity threats, refer to the Business and Operational Risks section of Item 1A. Risk Factors.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a robust risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.


text: A key part of the Company's cybersecurity program is the ITW Cybersecurity Framework, which is based on the National Institute of Standards and Technology's Cybersecurity Framework ("CSF") and is designed to protect the Company's data through rapid identification of and effective response to cybersecurity incidents. The Company's framework includes detailed processes and controls related to backup and recovery, response planning, awareness, vulnerability management and endpoint protection as well as cybersecurity requirements for third-party service providers. The framework is regularly reviewed, assessed, and updated based on input from third party specialists, threat intelligence firms and CSF standard updates.


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network and endpoint monitoring; • Vulnerability management and testing; and • Backup and recovery testing.


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2023, 2022 or 2021, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.


text: On a quarterly basis, or sooner if appropriate, cybersecurity incidents are summarized and reported to the Cybersecurity Governance Committee comprised of senior executives. Additionally, the Audit Committee of the Board of Directors receives quarterly cybersecurity reports from senior management which cover any identified cybersecurity incidents, results of third party vulnerability testing, and key developments in policies and practices during the quarter.


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network/endpoint protection, monitoring and response; • Vulnerability management and • Backup and recovery testing.


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2024, 2023 or 2022, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer ("CISO") and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.


text: The Company's cybersecurity program is overseen by a dedicated global team of cybersecurity professionals, led by the CISO who brings over 20 years of information technology and cybersecurity leadership experience and holds the Certified Information Security Manager ("CISM") designation. The CISO reports directly to the Chief Information Officer ("CIO") and is responsible for leading the execution of the Company's cybersecurity strategy.


text: Imperial recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the company integrates cybersecurity risks into its overall enterprise risk management system. The board of directors oversees the company's risk management approach and structure, which includes an annual review of the company's cybersecurity program.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: The company's cybersecurity program is managed by the Canada IT Manager, with support from cross-functional teams led by information technology (IT) and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: IT management provides updates to the company's senior management throughout the year, covering, as appropriate, the company's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans, as well as the evolving cybersecurity threat landscape.


text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: As of the date of this report, the company has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the company including its business strategy, results of operations, or financial condition.


text: While the company believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures the company is taking prove to be insufficient or if the company's proprietary data is otherwise not protected, see "Item 1A. Risk factors: Operational and other factors - Cybersecurity" in this report.


text: The company's cybersecurity program is managed by the Canada Information Technology (IT) Manager, with support from cross-functional teams led by IT and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate, and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: The Company has processes in place to identify, assess and manage risks from information security vulnerabilities and cybersecurity threats. The Company maintains and updates tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities that may affect the Company's information systems and data. The Company uses an enterprise vulnerability management platform to scan IT assets and report any known vulnerabilities associated with such IT assets. This platform enables the Company's Information Security Team to identify and prioritize solutions necessary to remediate any identified vulnerabilities. The Company's policies require that remediation be performed in a timely manner, including the completion of follow-up scanning to confirm the remediation of any identified vulnerabilities. Further, the Company's incident response program enables the identification and management of information security threats, risks and incidents. The incident response program is powered by technology that enables threat and event correlation across enterprise systems, user behavior analytics, anomalous behavior identification, network detection and response, end point detection and response, and an incident tracking system. The Company promptly engages the Computer Security Incident Response Team ("CSIRT") if a security incident is observed. The CSIRT is composed of lead personnel from the Company's IT department and employees who have been trained on the handling of information security incidents. The CSIRT may also engage third party incident response investigators that are on retainer to assist in incident response.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: The Company uses the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) as a guide for cyber risk management. The Center for Internet Security (CIS) Benchmarks and the Payment Card Industry (PCI) Security Standards are also followed to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS) and to assist with managing risk.


text: The Company has information technology security practices designed to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: Cybersecurity controls embedded in the Company's information technology systems; Regular implementation of changes to the Company's information technology systems to address potential threats and vulnerabilities; Incident response program, including proactive simulations to identify and manage cybersecurity threats, risks and incidents; Participation in industry forums and collaboration with peers; and Security awareness and data protection training for applicable employees.


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.


text: The Company evaluates risk associated with the engagement of any third-party through a lifecycle-based approach, conducting risk-based due diligence before an engagement, using contractual provisions to address risk, and, for certain third-parties, engaging in architectural review and validation prior to an engagement.


text: The Company has an Information Security Team composed of employees and a managed detection and response partner providing 24/7 coverage. Additionally, the Company utilizes third parties to assist with penetration testing, attack simulation, threat intelligence reporting, detection and incident response, as well as review and enhancement of associated response plans and processes.


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.


text: The Company is constantly evolving its information security strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, the Company has not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position.


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, and updates on the Company's incident response program and results are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.


text: Risk Management and Strategy Griffon relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company and with third parties. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade cybersecurity management program designed to assess, identify, protect, detect and respond to, and manage material risks from cybersecurity threats. To protect our information systems from cybersecurity threats, we use various information technology and cybersecurity tools to safeguard our systems and data, which help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: GRIFFON CORP

ticker: GFF


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.


text: Griffon has a third-party risk management program regarding the cybersecurity practices of its vendors and partners that is designed to oversee, identify, and minimize material risks from cybersecurity threats associated with the use of such third parties. This program involves vetting of third parties before engagement. Regular monitoring and reviews are conducted to ensure third party vendors and partners comply with Griffon's security standards.


text: From time to time, Griffon engages external experts, including cybersecurity assessors, consultants, and/or auditors to evaluate cybersecurity measures and risk management processes.


text: We also maintain a cyber incident response plan ("IRP") with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect us, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents, and (3) managing internal and external communications and reporting.


text: If a cybersecurity incident occurs, our incident response team ("IRT") is immediately notified, and Griffon management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. The IRT also coordinates further notifications, as applicable, to senior executives and organizational leadership, our Audit Committee and Board of Directors, business partners or service providers, and authorities.


text: Like most organizations, we and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. During the reporting period, Griffon has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operating results, and financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business strategy, operating results and financial condition. We continuously use threat models and cyber threat intelligence to identify relevant risks to our businesses and take active measures to mitigate these risks. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.


text: Griffon also has a Cybersecurity Management Committee, consisting of executives from Griffon and technology leaders from Griffon's business segments, that monitors and assesses progress and performance by Griffon's business segments in the area of cybersecurity; the results of such assessments are reported to the Audit Committee from time to time. The Chief Information Officers of each of HBP and CPP regularly provide updates on material cybersecurity risks to our senior management and to our Audit Committee, and along with their technology teams, are responsible for assessing and managing cybersecurity risks. Each of our business segment Chief Information Officers has over 20 years of experience in cybersecurity, information security, policy, architecture, engineering and incident response.


text: Risk Management and Strategy Cybersecurity is a critical part of risk management at IBM and is integrated with the company's overall enterprise risk management framework. The Board of Directors and the Audit Committee of the Board are responsible for overseeing management's execution of cybersecurity risk management and for assessing IBM's approach to risk management. Senior management is responsible for assessing and managing IBM's exposure to cybersecurity risks on an ongoing basis.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: From an enterprise perspective, we implement a multi-faceted risk management approach based on the National Institute of Standards and Technology Cybersecurity Framework. We have established policies and procedures that provide the foundation upon which IBM's infrastructure and data are managed. We regularly assess and adjust our technical controls and methods to identify and mitigate emerging cybersecurity risks. We use a layered approach with overlapping controls to defend against cybersecurity attacks and threats on IBM networks, end-user devices, servers, applications, data, and cloud solutions.


text: We draw heavily on our own commercial security solutions and services to manage and mitigate cybersecurity risks. IBM maintains a Security Operations Center ("SOC") that monitors for threats to IBM's networks and systems, utilizing threat intelligence provided by a range of sources, including the IBM Security X-Force Exchange platform, which maintains one of the largest compilations of threat intelligence in the world. We also rely on tools licensed from third party security vendors to monitor and manage cybersecurity risks. We periodically engage third parties to supplement and review our cybersecurity practices and provide relevant certifications.


text: We have a global incident response process, managed by IBM's Computer Security Incident Response Team ("CSIRT"), that relies primarily on internal expertise to respond to cybersecurity threats and attacks. We utilize a combination of online training, educational tools, videos and other awareness initiatives to foster a culture of security awareness and responsibility among our workforce, including responsibility for reporting suspicious activity.


text: IBM has a third party supplier risk management program to oversee and identify risks from cybersecurity threats associated with its use of third party service providers and vendors. Risks are assessed and prioritized based, among other things, on the type of offering/engagement, supplier assessments, threat intelligence, and industry practices.


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who coordinate with the Office of the CISO on security issues specific to particular business segments.


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") for Legal & Regulatory Affairs and General Counsel ("GC") and the SVP overseeing cybersecurity ("SVP Sponsor").


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Chief Privacy Office, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the GC and the SVP Sponsor, as appropriate.


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the GC. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.


text: The Board of Directors and the Audit Committee oversees the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from the increased use of AI, intentional acts of individual and groups of criminal hackers, hacktivists, state-sponsored organizations, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who are coordinated by the Office of the CISO on security issues specific to particular business segments.


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") and Chief Legal Officer ("CLO"), and the SVP overseeing cybersecurity ("SVP Sponsor").


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Office of Privacy and Responsible Technology, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the CLO and the SVP Sponsor, as appropriate.


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the CLO. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.


text: The Board of Directors and the Audit Committee oversee the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.


text: Risk Management and Strategy Our comprehensive Incident Response Plan outlines processes to identify, detect, assess, respond to and recover from threats, including cybersecurity threats. We follow those processes to manage material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation/legal risk; and reputational risk, as part of our overall risk management system and processes.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: In addition, our Enterprise Risk Management ("ERM") program considers cybersecurity risks alongside other company risks. Our enterprise risk professionals consult with cross-organizational leaders to gather information necessary to identify cybersecurity risks, evaluate their likelihood and severity, identify necessary mitigations and assess the potential impact of those mitigations on residual risk. Our ERM Committee, chaired by the Chief Financial Officer ("CFO") and General Counsel ("GC"), and comprised of senior leaders representing each risk domain, integrates global risks, including cybersecurity and compliance, to ensure appropriate prioritization of resources and alignment across the Company. The ERM Committee meets with our Executive Leadership Team and presents at least annually to our Board of Directors on the ERM process and on our risk mitigation actions, including providing reporting focused on compliance and cybersecurity risks.


text: Our Chief Information Officer ("CIO") is responsible for delivering on the Company's global Information Technology ("IT") strategy, including infrastructure, data and analytics, application delivery, end user services, cybersecurity risk management and the digital technology transformation program. The IT leadership team leads the implementation of the IT strategy and the day-to-day operations. Under the guidance of the CIO, our Chief Information Security Officer ("CISO") leads Information Security ("InfoSec"), which includes the Cyber Fusion Center, Infrastructure Security, including network segmentation, firewalls and intrusion detection and prevention systems, Identity and Access Management, Application Security, Data Security and InfoSec Governance, Risk and Compliance. InfoSec is overseen by the InfoSec Steering Committee, comprised of senior leaders representing all corporate functions and business units, and the InfoSec Governance Review Board, comprised of the IT leadership team and the InfoSec leadership team. InfoSec is governed in coordination with IFF's ERM Committee and is aligned to the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition to our dedicated leadership team overseeing InfoSec, we view InfoSec as a shared responsibility, and to best protect our network, computers and data from threats, we empower our employees to be our first line of defense. To that end, all employees globally complete annual mandatory InfoSec training on email security, password security and our Acceptable Use Policy. We use email security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing emails and avoid IT system interruptions.


text: Our comprehensive InfoSec Incident Response Plan is updated at least annually, and provides guidance for detecting, containing, eradicating and recovering from potential incidents. It outlines escalation procedures, reporting requirements, incident severity levels, a materiality assessment and roles and responsibilities for key partners, including IT, Legal/Employee Relations, Corporate Communications, Human Resources and other senior leaders. Our escalation procedures include escalation to our Executive Leadership Team, Audit Committee, Disclosure Committee, and Board of Directors, and reporting to regulators, customers, investors, and others. We also maintain cybersecurity insurance, regularly evaluate the effectiveness of our systems, and test our contingency plans by conducting vulnerability analysis and tabletop exercises with both technical incident responders and senior leaders.


text: Based on industry baselines and discussions throughout our membership in various global InfoSec communities, we believe that these preventative actions provide adequate measures of protection against information security breaches/incidents and reduce our cybersecurity risks. Given the evolving nature of InfoSec incidents, we regularly engage with our peers on threat intelligence and collaborate with organizations both in our industry and across industries to share best practices.


text: In connection with our InfoSec risk management processes, we engage third-party assessors and outside counsel. Our program includes review and assessment by external, independent third parties, who assess and report on our overall InfoSec program and identify areas for continued focus and improvement. Our CIO, CISO and GC oversee our technology risk management and privacy teams, which work in partnership with our Internal Audit team to review IT-related controls as part of the overall internal controls process and regulatory requirements. We consult with outside counsel to advise our team and our Board of Directors on best practices for InfoSec oversight, and the evolution of that oversight over time. InfoSec employees regularly speak at and attend industry events to ensure awareness of evolving threats and innovative prevention and remediation techniques. Further, our InfoSec risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers through relationship due diligence, InfoSec assessments and contractual provisions.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" – "A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, business or results of operations."


text: The Board of Directors is responsible for overseeing and reviewing with management the Company's InfoSec risks and the policies and practices established to manage such risks. In that effort, the Board of Directors delegates certain responsibilities to our Audit Committee. This committee-level focus on InfoSec allows the Board to further enhance its understanding of these issues as it continues to have overall oversight responsibility for risk.


text: The Audit Committee assists the Board of Directors in its oversight by staying apprised of our InfoSec programs, strategy, policies, standards, architecture, processes and material risks, and by overseeing response to InfoSec incidents. Our Audit Committee receives from management updates, at least quarterly, on material security risks, including any material incidents, relevant industry developments, threat vectors and material risks identified in periodic penetration tests or vulnerability scans. These updates also include material legal and legislative developments concerning InfoSec, our approach to complying with applicable law and material engagement with regulators concerning IT and InfoSec.


text: The Board of Directors receives regular reports from the Audit Committee which detail (a) InfoSec initiatives, (b) reviews of the policies and practices established to manage these processes, and (c) reviews of the Company's procedures for monitoring compliance with applicable laws. Additionally, the Board of Directors also receives updates on the Company's risks through ERM program reports, which include management's approach to mitigating and managing InfoSec risks.


text: Members of the Board of Directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management, as appropriate, to address the effectiveness of our overall data privacy and cybersecurity program. Recently, members of the Board of Directors and Executive Leadership Team participated in a Cybersecurity Exercise led by our CIO and CISO as training, and, to prepare for incident response. The Board of Directors and Audit Committee also receive regular cybersecurity posture reports from an external third-party, and outside counsel advises the Board of Directors on best practices for the Board's oversight of InfoSec and the evolution of that oversight over time. Additionally, two members of our Board of Directors and Audit Committee have experience in InfoSec matters.


text: Our Board of Directors and Audit Committee's principal role is one of oversight, recognizing that management, led by our CIO and CISO, is responsible for the design, implementation and maintenance of an effective program for identifying, detecting, protecting against, responding to, recovering from and mitigating data privacy and InfoSec risks. Our CIO has more than 30 years of technology experience, including leadership across a variety of enterprise technologies, including InfoSec, and across multiple industries. Our CISO has more than 20 years of experience in InfoSec, across multiple industries, and is a Certified Information Systems Security Professional (CISSP). The CIO and CISO provide, at least, annual updates on IT and InfoSec initiatives to the Board of Directors and quarterly updates to the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" —"A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, productivity, business or results of operations."


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity risk management processes are integrated into the Company's overall risk management system. The Company has a formalized enterprise risk management program overseen by the Board of Directors and committees of the Board of Directors that addresses strategic, operational, financial, compliance, legal and information technologies and cybersecurity risks. In addition, the Enterprise Risk Management Council ("ERM Council") is a management-level team comprised of senior vice presidents and other business leaders responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on the Company's business and financial results. The ERM Council regularly reports to the Board of Directors on areas of risk and risk management. The Chief Financial Officer serves as the ERM Council Lead. The Chief Audit Executive serves as the ERM Council Process Owner.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with the enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. The IT Risk Governance Program identifies, defines, manages, measures and governs cybersecurity risks across the Company at an enterprise level. The IT Risk Governance Program is carried out by an IT Risk Identification and Mitigation Team ("IT RIM"), which is comprised of business leaders from information security, information technology, human resources, internal audit, legal, and risk. The IT RIM meets monthly, reviews all cybersecurity incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a management level, and reports to the ERM Council.