text: The Company conducts due diligence prior to engaging third-party service providers which have access to the Company's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Seacoast requires critical and high-risk providers to have an ongoing monitoring plan.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and cybersecurity risk has increased in recent years. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. See Item 1A. "Risk Factors" for further discussion of the material risks associated with an interruption or breach in our information systems or infrastructure.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF

secItem: Item 1C


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee ("ITC").


text: The Enterprise Risk Management Committee ("ERMC") of the Board has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO and CIO attend ITC and ERMC meetings and provide cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program summary report to the full Board of Directors. Our CRO, in conjunction with our CISO and CIO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CISO, the Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. In 2023 our CISO reported to our CIO; however, for 2024 the CISO will report to our CRO, who in turn reports to our CEO.


text: Our CISO has cybersecurity experience spanning more than 20 years. Prior experience includes serving as the CISO at a mid-size regional financial institution and serving in manager roles at large professional services firms. He holds a degree in Computer Science and Mathematics and maintains several industry certifications.


text: Cybersecurity Risk Management and Strategy The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer, who reports to our Chief Risk Officer, manages our information security strategy and development within our overarching Enterprise Risk Management program.


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third party technology and expertise as appropriate.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the CEO, CFO, CRO, Head of Legal, and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee.


text: The Enterprise Risk Management Committee of the Board has primary responsibility for overseeing the Company's comprehensive ERM program. The ERM program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO attends ITC and ERMC meetings and provides cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program to the full Board of Directors. Our CRO, in conjunction with our CISO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. The Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats.


text: Our CISO has cybersecurity and information technology experience spanning more than 30 years. Prior experience includes serving as the CISO for a multi-national cloud hosting organization serving the legal community and several senior leadership roles in both information technology and information security at a large financial institution, Fortune 500 organizations and a large professional services firm. The CISO holds a degree in Computer Science and maintains appropriate industry certifications.


text: Cybersecurity Risk Management and Strategy The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the NIST Cybersecurity Framework. HCSG regularly monitors and measures the performance of its IT System and Assets and its Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize, or process HCSG's data take a similar, risk-based approach to information security.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Management maintains the cybersecurity risk prevention program which includes ongoing employee education and procedures for cybersecurity incident prevention, detection and response. The Company retains third parties, including IT professionals and legal counsel, specializing in cybersecurity risk management to assist in implementing cybersecurity controls. The Company oversees and identifies material risks from cybersecurity threats associated with its use of third-party service providers by reviewing SOC 1 or SOC 2 reports (whichever is more applicable) for key outsourced systems, including all systems which house protected health information or personally identifiable information. The cybersecurity risk prevention program is part of the Company's overall risk management program.


text: Please refer to the risk factor titled "Cyber-attacks and breaches could cause operational disruptions, fraud or theft of sensitive information" in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.


text: The Company has a Cyber Incident Response Plan ("IRP") which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, the Chief Compliance Officer provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.


text: Board of Directors' Oversight of Cybersecurity Risks Our Board is responsible for overseeing the Company's risk management process. The Board focuses on the Company's general risk management strategy, including the most significant risks facing the Company, and ensures that appropriate risk mitigation strategies are implemented by management. The Audit Committee oversees the Company's cybersecurity risk mitigation efforts. The Audit Committee reports to the full Board as appropriate, including when a matter rises to the level of a material risk.


text: Cybersecurity Risk Management and Strategy The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the National Institute of Standards and Technology Cybersecurity Framework. The Company regularly monitors and measures the performance of the IT Systems and Assets and the Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize or process our data take a similar, risk-based approach to information security.


text: Please refer to the risk factor titled "We have experienced cyber attacks and breaches, and may in the future experience cyber attacks and breaches which could cause operational disruptions, fraud or theft of sensitive information." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.


text: As previously disclosed in a Form 8-K filed on October 16, 2024, on October 9, 2024 we identified a cybersecurity incident, which involved unauthorized activity within some of our systems. We immediately activated the Company's Cyber Incident Response Plan ("IRP") to investigate such activity with the assistance of leading third-party cybersecurity experts. We also notified law enforcement authorities. We continue to monitor the situation and take appropriate actions consistent with our response protocols. As of the date of this filing, the incident has not caused, and is not expected to cause, disruption of the Company's business operations. And although there can be no assurance, we do not believe the identified cybersecurity incident will have a material effect on our business, financial condition, results of operations or cash flows.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.


text: The Company has an IRP which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, Mr. Bundick provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.


text: UnitedHealth Group manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and Chief Information Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Chief Digital and Technology Officer and Chief Information Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We have obtained various certifications from industry-recognized certifying organizations as a result of certain external audits. We also perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit and Finance Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Chief Digital and Technology Officer and Chief Information Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Information Security Officer has experience leading a global digital portfolio for a large multinational corporation and held key leadership roles for a large technology and software company, including overseeing information security, before joining UnitedHealth Group.


text: As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident, which we believe was committed by cybercrime threat actors. As of the date of this report, we have not determined the incident is reasonably likely to materially impact our financial condition or results of operations.


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and our Chief Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the effectiveness of the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and the Chief Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Audit and Finance Committee has also added a leading cybersecurity incident and response firm to serve as its advisor on cybersecurity matters.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of significant threats and incidents to management, including the Chief Digital and Technology Officer and the Chief Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee and appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and evaluate whether they employ appropriate and effective controls and continuity plans for their systems and operations.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to address unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Chief Digital and Technology Officer and our Chief Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Security Officer has more than 30 years of experience as a security professional in both the private and public sectors, including in law enforcement. Prior to joining UnitedHealth Group, he served in security leadership roles at several large multinational corporations and has additionally served on cybersecurity advisory boards for some of the largest corporations in the country.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: We continuously assess our risk of cyber threats to adapt quickly to the ever-changing challenges and risks surrounding cybersecurity. Atmos Energy has implemented policies, procedures, and controls to identify, protect, detect, and respond to cyberattacks or acts of online terrorism. Atmos Energy is also subject to the U.S. Department of Homeland Security Transportation Security Administration (TSA) security directive for our natural gas pipeline monitoring and control systems.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: The potential impact of cybersecurity risks on our business operations, results of operations, or financial condition is discussed in the "Technology and Cybersecurity Risks" section of Item 1A "Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties, or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to identify, protect, detect, and respond from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations, and financial condition in the future. The following describes our risk management and strategy and corporate governance as it pertains to cybersecurity.


text: Risk Management and Strategy Atmos Energy's cybersecurity program leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) in its design of controls intended to reduce the risk and potential impact of cybersecurity incidents. This comprehensive approach encompasses continuous monitoring, risk assessments, a cybersecurity incident response plan, and regular evaluations to align our practices with industry standards. Additionally, we actively engage in cybersecurity risk management practices and continually improve procedures and practices to support the continued safe and reliable delivery of natural gas to our customers.


text: The identification and management of cybersecurity risk is a component of our Integrated Risk Management process, which applies adaptive process improvement to help us respond to the changing cybersecurity landscape. Additionally, we use third parties to enhance our collective capability to monitor, detect, and respond to cybersecurity incidents. Further, we maintain collaborative relationships with government officials, law enforcement, and industry peers to keep informed of trends and potential cyber tactics. Finally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: We have an information technology cybersecurity incident response plan to manage cybersecurity incidents. The plan provides guidelines for actions in response to cyber security incidents that may occur at or otherwise affect Atmos Energy. These guidelines include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors. This plan, which is periodically reviewed and tested, is supported by third parties to provide guidance and support to our cybersecurity management team.


text: We also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or our information technology systems. Atmos Energy currently conducts cyber assessments on potential vendors that will have access to information technology systems, data or facilities that house such systems or data. Following approval, those vendors are contractually required to manage their cybersecurity risks and provide notification in the event of a cybersecurity incident.


text: Our Vice President and Chief Information Officer (CIO), who has over two decades of experience in information technology, is responsible for overseeing our cybersecurity program. The CIO oversees an IT Information security team responsible for our overall cybersecurity program. This team is comprised of several IT professionals with varying degrees of cybersecurity experience and is led by our Director – Cybersecurity who has over 30 years of experience in information technology and cybersecurity. The Director – Cybersecurity reports to the CIO, who reports to the Senior Vice President and Chief Financial Officer.


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary and Senior Vice President, Human Resources. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.


text: The Audit Committee of the Board of Directors oversees the company's cybersecurity risks. Additionally, our Board of Directors periodically engages with third-party advisors to provide further education about cybersecurity risks.


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary, Senior Vice President, Human Resources, and Senior Advisor. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Our operations are dependent on our ability to process financial transactions in a secure manner. Failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers, could disrupt our business or the businesses of our customers, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.


text: We seek to use a defense-in-depth approach for cybersecurity management, layers of technology, policies and training at all levels of the enterprise designed to keep our assets secure and operational. We use various processes as part of our efforts to maintain the confidentiality, integrity and availability of our systems, including security threat intelligence, incident response, identity and access management, endpoint extended detection and response protection, network segmentation, data encryption, and event monitoring. In an effort to validate the effectiveness of our cybersecurity program and assess such program's compliance with legal and regulatory requirements, we engage third-party service providers to perform audits, assessments and penetration tests.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. All employees who have access to our systems are required to undergo annual cybersecurity training and, each year, our employees must review and acknowledge our cybersecurity policies. Further, our Information Systems team is trained to understand how to manage, use and protect personally identifiable information. User access controls have been implemented to limit unauthorized access to sensitive information and critical systems. Employees are required to use multifactor authentication and keep their passwords confidential, among other measures.


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, before contracting with certain technology service providers, when possible, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and to require them to adhere to security standards and protocols. Finally, we maintain cybersecurity insurance coverage.


text: Impact of Risks from Cybersecurity Threats While we have not been materially impacted by cyber incidents, we have been subject to other intentional cyber incidents from third parties over the last several years, including denial of service attacks which attempt to interrupt service to customers and malicious software attacks on computer systems which attempt to allow unauthorized entrance. We also face risks related to cyber attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber attacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third party service providers to conduct other aspects of our business operations and face similar risks relating to them. While we conduct security assessments on our higher risk third party service providers, we cannot be sure that their information security protocols are sufficient to withstand a cyber attack or other security breach. There can be no assurance that cyber incidents will not occur and they could occur more frequently and on a more significant scale.


text: Board of Directors' Oversight and Management's Role Our Information Systems team is responsible for our efforts to comply with applicable cybersecurity standards, establish effective cybersecurity protocols and protect the integrity, confidentiality and availability of our Information Systems infrastructure. This team is responsible for cybersecurity threat prevention, detection, mitigation and remediation for the combined organization. Our cyber incident response plan requires all detections of suspicious activity in our Information Systems environment to escalate that activity to our Information Security Team who then evaluates the threat. Management (including representatives from the legal, operations, human resources, Information Systems and risk management departments) is notified by the Information Services team whenever a discovered cybersecurity incident may potentially have a significant impact on our business operations.


text: Our Board of Directors has delegated the responsibility for the oversight of cybersecurity risks to the Information Security and Technology Committees, which are ultimately responsible for assessing and managing our material risks from cybersecurity threats. The Information Security team and the Information Security Committee provide periodic cybersecurity program updates to senior management and to the Board. Management also updates the Board as new risks are identified and the steps taken to mitigate such risks.


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Services Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.


text: Cybersecurity Program Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework. Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification. We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection. We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation. Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation. Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis. We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer and other senior executives are part of the notification chain.


text: Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and their team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.


text: The CISO brings nearly two decades of cybersecurity experience to their work at Verizon. Prior to joining Verizon, they held executive-level cybersecurity roles at other large public companies, where they were responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of their leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the presidents of Verizon Global Services and Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.


text: Verizon's Management Audit Committee (VMAC), which includes our Chief Financial Officer, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.


text: Verizon also operates a robust internal audit program. Each year, Verizon's internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. The results of the assessment are presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.


text: Board Oversight of Cybersecurity Risk The Audit Committee of the Board of Directors (Board) has primary responsibility for overseeing Verizon's risk management and compliance programs relating to cybersecurity and data protection and privacy.


text: As part of the Board's oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the full Board dedicated to Verizon's cybersecurity risks, threats and protections. The CISO provides a mid-year update to this annual review to the Audit Committee and, as warranted, additional updates throughout the year. The Audit Committee also receives a report from senior management on Verizon's cybersecurity posture and related matters at each of its other meetings during the year at which the CISO is not present.


text: Supplier Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Supplier Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyber attacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While, to date, we have not been subject to cyber attacks that, individually or in the aggregate, have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Program Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework - Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification - We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection - We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation - Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation - Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis - We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.


text: Our processes for assessing, identifying, and managing cybersecurity risks include tabletop exercises to test and reinforce our incident response controls, control gap analyses, penetration tests, data recovery testing, internal and external security assessments, and threat intelligence monitoring. We also conduct annual cybersecurity and data privacy training, which is mandatory for all our full- and part-time employees. In addition to our in-house cybersecurity capabilities, we also engage assessors, consultants and other third parties to assist with various cybersecurity matters. For example, Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer (CEO) and other senior executives are part of the notification chain.


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and her team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.


text: The CISO brings nearly two decades of cybersecurity experience to her work at Verizon. Prior to joining Verizon, she held executive-level cybersecurity roles at other large public companies, where she was responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of her leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer (CFO) and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the head of Verizon Global Services and the President of Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.


text: Verizon's Management Audit Committee (VMAC), which includes our CFO, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.


text: Third Party Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Third Party Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyberattacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While none of the cyberattacks to which we have been subject to date have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience a material cyberattack in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyberattacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Board and Audit Committee Oversight Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receives reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.

companyName: AT&T INC.

ticker: T


text: Chief Security Office/CISO We maintain a Chief Security Office (CSO), which is charged with management-level responsibility for all aspects of network and information security within the Company. Led by our CISO and comprised of a large team of highly trained security professionals across multiple countries, the CSO is responsible for: a.establishing the policies, standards and requirements for the security of AT&T's computing and network environments;


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events, and overseeing the execution of corrective actions;


text: c.promoting compliance with AT&T's security policies and network and information security program in a consistent manner on network systems and applications; and d.providing security thought leadership in the global security arena.


text: Our CISO plays the key management role in assessing and managing our material risks from cybersecurity threats. The CISO also works closely with AT&T Legal to oversee compliance with legal, regulatory and contractual security requirements. The CISO has extensive technical leadership experience and cybersecurity expertise, gained from approximately 20 years of experience, including serving as the Chief Information Security Officer and Director of the Office of Cybersecurity at a U.S. government agency, in addition to serving as the Chief Information Security Officer of two large public companies. Prior to that, he served for 20 years in the U.S. military, in various information technology roles of increasing seniority. The security professionals in the CSO have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications.


text: Risk Management and Strategy We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity, or availability. Our program encompasses the CSO and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers; and the program is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence. AT&T Inc.


text: Dollars in millions except per share amounts With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: Impact of Cybersecurity Risk In 2023, we did not identify and were not aware of any cybersecurity breaches that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks or systems may have a material adverse effect on our operations" of Item 1A.


text: Board and Audit Committee Oversight Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receive reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events and overseeing the execution of corrective actions;


text: Risk Management and Strategy We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity or availability. Our program encompasses the CSO and its policies, platforms, procedures and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. The program is integrated into our overall risk management framework and is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. When circumstances warrant, we also retain external cybersecurity experts to assist the CSO. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate AT&T Inc.


text: Dollars in millions except per share amounts with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence.


text: With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: Impact of Cybersecurity Risk In 2024, we did not identify and were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks, systems or data or those of our suppliers or vendors may have a material adverse effect on our operations or results of operations" of Item 1A.


text: Cybersecurity Risk Management Program and Strategy We understand the importance of maintaining a robust cybersecurity program to assess, identify, and manage the material risks associated with cybersecurity threats.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology ("NIST") framework, which organizes the management of cybersecurity risks into five categories: identify, protect, detect, respond, and recover.


text: The Chief Technology Officer of Brighthouse Financial (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity program. The Chief Information Security Officer of Brighthouse Financial (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team, as well as the services of third-party consultants, to assess and evaluate the effectiveness of our controls (in alignment with the NIST framework) and to improve our security measures and strategy. The cybersecurity team has also engaged a third party to measure the Brighthouse Financial cybersecurity program against the NIST cybersecurity framework. The results of this assessment confirmed the rigor of our cybersecurity risk management practices.


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents, as applicable. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, associates outside of our technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulations, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to company policies that we make available to all employees, our awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of whom have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. We have not experienced any cybersecurity incidents to date, directly or indirectly, that have materially impacted our business, financial condition, or results of operations. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Cybersecurity Risk Management Program and Strategy We understand the importance of maintaining a robust cybersecurity risk management program to assess, identify, and manage the material risks associated with cybersecurity threats.


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity risk management program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"), which provides standards, guidelines and best practices on managing cybersecurity risk, as well as the organization, improvement and assessment of Brighthouse Financial's cybersecurity risk management program.


text: The Chief Technology Officer of BHF (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity risk management program. The Chief Information Security Officer of BHF (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity risk management program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity risk management program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity risk management programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team. Brighthouse Financial also engages the services of third-party consultants to assess and evaluate the effectiveness of our controls (in alignment with the NIST Framework), to improve our security measures and strategy, and to review the Brighthouse Financial cybersecurity risk management program against the NIST Framework. The results of the most recent assessment of Brighthouse Financial cybersecurity risk management program confirmed the rigor of our cybersecurity risk management practices.


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that is designed to coordinate the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact of the incident, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, associates outside of our information technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulated phishing campaigns, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all associates. In addition to Company policies that we make available to all associates, our cybersecurity awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of which have access to our customer and associate data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. Based on the information available as of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. The Chief Compliance Officer of BHF also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. Furthermore, a material cybersecurity incident could harm our business and reputation and diminish our competitive position.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: In order to mitigate cybersecurity risk, LiveRamp maintains a security program based on widely known and accepted industry standards, including NIST CSF, ISO 27001, and SOC 2. Aligning to these standards allows our program to adjust to changing conditions such as new technology, industry best practices, or organizational risk tolerance.


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.


text: LiveRamp maintains a Security Charter which establishes the overall security program, appoints responsibility and authority to the Chief Information Security Officer (CISO), and establishes a Security Action Committee (SAC) to provide leadership and oversight. LiveRamp's CISO has over 20 years of experience as the Company's security leader, and maintains several industry standard security certifications. The members of the security leadership team, who report directly to the CISO, each have at least a decade of experience relevant to their area of responsibility.


text: The SAC includes leadership across our security, enterprise risk management, internal audit, engineering, product, data ethics, legal, and commercial teams. The SAC is responsible for reviewing and approving major updates to LiveRamp's security policies and standards, reviewing and recommending actions related to exceptions to the security program, ensuring that the security program is in alignment with business objectives, ensuring that the organization has appropriate training and awareness related to security, and providing leadership and support for the security program.


text: Cyber security is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.


text: Security Risk Management LiveRamp also maintains a security risk management program overseen by our CISO and aligned with the Company's overall Enterprise Risk Management strategy. The security risk management program includes processes for consistently identifying, classifying, analyzing, and documenting risk. Throughout the year, LiveRamp's security team conducts risk assessments focused on a particular product or compliance scope. Risks are documented and communicated to relevant stakeholders. In addition to internal teams and resources, LiveRamp leverages a variety of third parties in support of our security risk management efforts. Third-party managed services are used to support functions including our Security Operations Center, forensic incident response, and incident response tabletop exercises. Third-party providers are also utilized for penetration testing and for a bug bounty program. Third-party tooling is utilized in support of functions including threat intelligence, security logging, security information and event management (SIEM), vulnerability scanning, email protection, security awareness training, secure development training, cloud posture management, secret management, identity and access management, and anti-malware. Furthermore, following the shared responsibility model with our cloud service providers, we rely on their implementation of certain security controls, such as physical security.


text: External auditors regularly review LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent review of the capability maturity of LiveRamp's security program.


text: In order to mitigate risk associated with the use of third parties, LiveRamp maintains a third-party risk management program, incorporating the review of third parties by data ethics and security teams. A third party's inherent security risk is determined by identifying their level of access to our systems and data. Third parties with a high inherent risk or with access to sensitive data types undergo a review of their security controls, wherein LiveRamp reviews the third party's responses to a security due diligence questionnaire, external audit reports, penetration test reports, and/or security policies. A residual score is then determined based on the third party's controls and/or operational impact to LiveRamp. LiveRamp does not approve the use of any third parties with an inadequate security posture. For third parties handling personal information, LiveRamp also conducts legal and privacy due diligence to assess legal and privacy risks and apply mitigations where appropriate. LiveRamp security also conducts ongoing monitoring of existing third parties. On a cadence determined by the third party's residual risk level, controls are re-evaluated to ensure that the security controls of the third party have not been diminished.


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. While we do not believe our strategy, operations, and financials have been materially affected by risks from cybersecurity threats, we cannot provide assurances that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit/Finance Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.


text: Cybersecurity is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.


text: External auditors regularly examine LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent assessment of the capability maturity of LiveRamp's security program.


text: We rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: TRANSCONTINENTAL REALTY INVESTORS INC

ticker: TCI


text: The Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: Risk Management and Strategy The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into its Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. The Corporation reassesses all suppliers on a regular interval.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit and IT Committees, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks.