text: Our newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and complexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system.


text: As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity incidents.

companyName: CORPAY, INC.

ticker: CPAY

secItem: Item 1C


text: We have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents that we face, refer to Part I, "Item 1A. Risk Factors."


text: Use of Third Parties To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.


text: In order to oversee and identify risks from cybersecurity threats and incidents associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.


text: Board of Directors Oversight The Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our information technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.


text: To accomplish this purpose, the information technology and security committee has four primary responsibilities: • to understand the security controls and assessments conducted on major card platforms and concur that such controls are comparable to industry best practices and standards as appropriate; • to assess technology modernization plans and processing platform strategies to validate proper investment in multi- year initiatives that maintain effective and efficient use of Company resources; • to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to drive quality and timeliness; and • to evaluate the prioritization of strategies for intellectual property protection.


text: Management's Role The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among others. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates also include updates on our continued compliance with regulatory requirements. Our information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.


text: Our CISO, who reports directly to our CIO, has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.


text: Our CISO manages our information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cybersecurity threat detection and incident response. Our CISO informs and updates the Board about any information security incidents that may pose a significant risk to us.


text: Our cybersecurity risk management program includes: • Periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. • A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents, supported by a virtual Chief Information Security Officer ("vCISO") that we have engaged through a third-party IT security firm. • The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls. • Our Internal Audit department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment. • Periodic cybersecurity awareness training for our employees and contractors with access to our information technology systems.

companyName: Bloom Energy Corp

ticker: BE


text: Index to Financial Statements • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including incidents that could be indicators of attack against availability, integrity and confidentiality of information systems. • A third-party risk management process for service providers, suppliers, and vendors that includes examining their security postures and assessing their data and system protection controls.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. For a discussion of how cybersecurity risks could materially affect us in the future, please see the risk factors set forth under the caption Part I, Item 1A, Risk Factors — Risks Related to our Operations.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the Audit Committee and management on these and other activities. The Audit Committee receives periodic reports from management on our cybersecurity risks, including presentations from our Chief Information Officer, vCISO, internal security staff, and external experts. This includes updates to the Audit Committee, as appropriate, regarding any significant cybersecurity incidents, or multiple incidents that could be significant in the aggregate. These updates may occur in between regularly scheduled Audit Committee meetings.


text: At the management level, the Enterprise and Risk Management Committee (the "ERM Committee") discusses cybersecurity topics, including any potentially material cybersecurity incidents, as part of its oversight of the company's significant risks. Our Chief Information Officer, collaborating with the broader management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our Chief Information Officer has more than 20 years of cybersecurity and information technology experience and she has served as the Chief Information Officer for multiple technology companies. Our vCISO and their third-party IT security firm includes a global team of cybersecurity professionals with significant industry experience. Similarly, the members of the ERM Committee possess significant risk management experience obtained by their collective years of experience at Bloom and other companies of similar or greater complexity.


text: Material Cybersecurity Incidents. While we have experienced several security incidents in the past, we have not experienced any material cybersecurity incidents for the fiscal year ended December 31, 2024. We do not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition.

companyName: OneSpan Inc.

ticker: OSPN


text: The CIO leads our global information technology organization and has nearly 30 years of information technology leadership experience, including acting as CIO at two cloud-based technology providers. The Chief Technology Officer has over 20 years of experience leading product management, engineering, and operational teams at global organizations, including at a fraud management and information security company. The Senior Vice President of Research and Development has more than 25 years of information technology experience, including at another publicly traded technology company. Our CISO reports to the CIO and is responsible for leading our information security organization and overseeing our information security program. The CISO has over 20 years experience in information technology and security, including serving as Chief Information Security Officer at another cloud-based technology provider. Team members who support our cybersecurity risk management program have relevant education and experience in the fields of cybersecurity, risk management, security architecture, data protection, application security, audit, compliance, incident response, identity governance and governance of enterprise information technology.


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, and consultants to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these assessments are reviewed with management and the Board.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Governance & Board Oversight The cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"). The CISO plays a pivotal role in informing the Board on cybersecurity risks.


text: Management, including the CISO, provides comprehensive briefings to the Board on cybersecurity risks at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the Board is regularly briefed on updates related to the Company's Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the Board and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks and updates on any significant developments in the cybersecurity domain.


text: Management's Role Managing Risk The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures. Furthermore, the program includes a formal information security training program for that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, and the Head of Internal Audit, to evaluate cybersecurity risks in alignment with our business objectives and operational needs. The CIO oversees the Company's security team and the CISO and has participated in the NIST review and validation of security procedures and processes.


text: The individuals responsible for evaluating and managing the Company's cybersecurity risk have extensive experience managing organizational risk and implementing cybersecurity programs at companies. The CIO has more than 20 years of experience advising on the overall strategy of technology, including the incorporation of cyber security into the software development lifecycle and change management process. The CISO possesses more than 10 years of relevant expertise in cybersecurity and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA"). The Chief Financial Officer has experience assessing and managing material financial risks, including cybersecurity risks, and serving on the Disclosure Committee at public companies. The Chief Legal Officer possesses many years of experience managing legal and compliance risk at public companies, including with respect to cybersecurity incidents. The Head of Internal Audit manages the Company's broader risk management framework, which includes cybersecurity risks, and has many years of prior experience assessing cybersecurity risks and programs at several companies.


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statements of Operations for the year ended December 31, 2023, and any reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2024, and 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "We depend on information technology systems to operate our business. A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and the data of our partners ("Information Systems and Data").

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our Chief Financial Officer ("CFO") and our information technology ("IT") department help identify, assess, and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting threat and vulnerability assessments, and performing audits.


text: For a description of the risks from cybersecurity threats that may materially affect our business and how they may do so, see the section titled "Risk factors" in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties with whom we work, are compromised, now or in the future, we could experience adverse consequences resulting from such a compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CFO, Mr. William McCombe. Mr. McCombe has experience in the security of both corporate and technical systems as well as business continuity planning in previous roles at various companies.


text: Our security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and senior director of global information technology. Our CFO works with our IT department to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to our board of directors for certain cybersecurity incidents.


text: We maintain policies and controls designed to identify, assess, manage, mitigate, protect against, and respond to cybersecurity threats. Our cybersecurity risk management strategy is established by management and is implemented by our IT professionals and the business units in which potential threats may occur. The Audit Committee of our Board of Directors (the "Audit Committee") has primary responsibility for overseeing management's strategy related to mitigating risk associated with cybersecurity threats. We maintain: (i) business continuity and disaster recovery plans that are expected to be deployed in response to a significant cyberattack; (ii) cyber incident response plans; and (iii) cybersecurity insurance that, subject to policy coverage and limitations, protects against financial harm to the Company caused by material cybersecurity events. While we believe our cybersecurity risk management strategy is appropriate for our current business, no strategy can fully protect against all possible adverse events. See "Item 1A. Risk Factors—Industry and Market Risks—Our business could be adversely affected by events outside of our control, including armed conflicts, war, terrorist attacks or threats, pandemics, natural disasters, cyber-based attacks, or other significant events."

companyName: Talen Energy Corp

ticker: TLN


text: Cybersecurity and Risk Mitigation Our cybersecurity policies are guided by standards or recommendations issued by, among others, the National Institute of Standards and Technology, the International Organization for Standardization, the NRC, and NERC. We deploy, configure, and maintain technologies and procedures designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard our material assets.


text: Our digital and cybersecurity controls are augmented with physical controls such as security systems, security site plans, security systems monitoring, and access control to mitigate physical security risks at our facilities. Our procurement policies and organizational controls require certain vendors to be assessed and vetted, with enhanced protocols on purchases and installations involving nuclear equipment. Additionally, cybersecurity reviews are performed on critical intellectual property vendors. Additionally, where warranted, we request a detailed cybersecurity questionnaire from our vendors to assess the vendor's practices and preparedness in addressing cyber threats.


text: Through a multi-functional coordinated effort, we assess and mitigate cybersecurity risks across our business units based on likelihood of the risk and potential impact to the business unit, the Company, and our stakeholders. These risks are identified using tactical, operational, and compliance-based approaches. Risks and associated consequences, should they materialize, are evaluated using likelihood of occurrence considering existing controls and technologies.


text: Our employees, as well as certain contractors, are required to complete cybersecurity awareness and training programs. Mandatory technical training is provided to employees and vendors performing, verifying, or managing cybersecurity activities. Mitigation efforts also include annual cyber crisis response simulations and annual training.


text: Third parties conduct periodic assessments on our cyber-related systems. To measure our non-nuclear cybersecurity framework maturity, we utilize internal and external audits and assessments, vulnerability testing, and governance processes. Our nuclear cybersecurity program is inspected biennially by the NRC and assessed annually by a quality assurance audit. Nuclear vulnerability management is implemented in collaboration with Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency.


text: We have cyber incident response plans to manage significant cybersecurity incidents across different aspects of our operations. Cybersecurity incidents are escalated based on significance to our Chief Administrative Officer, Chief Nuclear Officer, Chief Fossil Officer, General Counsel, Chief Financial Officer, Chief Executive Officer, Audit Committee, and (or) Board of Directors.


text: Cybersecurity Governance The Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Periodic reports are given by senior management to the Audit Committee about material cyber events and our risk mitigation efforts.


text: Our senior executive team is responsible for the coordination of cybersecurity across the Company. Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders. The cybersecurity teams have experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources. In coordination with our senior management, the relevant cybersecurity teams review risk management strategies to mitigate cybersecurity risks. Additionally, as needed, we engage specialists, consultants, auditors, and (or) other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: While cybersecurity incidents have not materially affected the Company or our business strategy, results of operations, or financial condition to date, no assurance can be provided that we will not be subject to a significant cybersecurity incident in the future. See "Item 1A. Risk Factors—Industry and Market Risks—Our business could be adversely affected by events outside of our control, including armed conflicts, war, terrorist attacks or threats, pandemics, natural disasters, cyber-based attacks, or other significant events." for additional information on our cybersecurity risks.


text: Security Awareness Education. Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees around information security and data privacy.

companyName: Archer Aviation Inc.

ticker: ACHR


text: Cybersecurity Service Providers and Third-party Consultants. We engage cybersecurity consultants and other third parties to assess and enhance our information security practices. These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements. We also utilize third-party tools and technologies to support our efforts to enhance our cybersecurity functions.


text: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and cyber governance. In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss technology and cybersecurity risks and the Company's risk assessment and risk management policies, practices, programs and/or procedures that have been adopted to monitor, control, mitigate and manage such risks. In addition, the Audit Committee reviews management's reports on topics, including risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration.


text: Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.


text: We are continuing to develop and refine processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats. Our Chief Information Officer, who has served in various leadership roles in information technology for over 20 years, provides leadership for our cybersecurity team. He also leads our overall corporate technology team, which has over 20 years of combined information security experience.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors— We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our aircraft, as well as our customer and other confidential data or proprietary information processed by us or third-party vendors."


text: As a multi-line insurance company, our business operations rely upon secure information technology systems for data processing, storage, and reporting. We maintain a cybersecurity risk management program based on recognized standards like the National Institute of Standards and Technology Cybersecurity Framework, other industry standards, and contractual requirements. The Chief Information Security Officer (CISO) oversees the cybersecurity program, which includes employee education, proactive threat investigation, prompt response to potential incidents, third party service providers, and other facets of a cybersecurity risk management program. Despite security and controls design, the information technology systems could become subject to cyberattacks. Unauthorized access to or unintentional dissemination of confidential, highly sensitive customer, employee, or company data through breach in our facilities, networks, or databases, or those of our agents or third-party information technology and software vendors, could result in loss or theft of assets or operational disruption. During the last fiscal year, we did not identify any material effect from actual or risks of cybersecurity events.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: The CISO is responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations and third-party risk assessments; identifying and keeping abreast of developing security threats; as well as overseeing and implementing regular security awareness training of all employees on cybersecurity. For example, we adjust our policies, standards, and processes based on assessment results. In leading the cybersecurity risk management program, the CISO regularly works with other divisions of the company, including legal, compliance, IT, audit, and others to address potential risk from external threats, internal actions, and relationships with third-party service providers.


text: The Board of Directors exercises risk management oversight, including cybersecurity risk, through the Audit Committee. The Audit Committee receives quarterly reports on our risk management program. These include regular reports from the CISO on the state of our cybersecurity risk management program and updates on cybersecurity matters, key cybersecurity initiatives, risk mitigation efforts, and assessments of emerging threats.


text: The CISO is responsible for identifying and reporting any cybersecurity incidents to the Disclosure Committee. A preliminary assessment of nature and scope of potential incidents is conducted by a cross-functional team, including information security, compliance, legal, and other participants as necessary. Using a risk-based process, incidents are escalated to the Disclosure Committee. The Disclosure Committee is composed of senior executives from across Horace Mann and has oversight over SEC disclosure controls. After notification, the Disclosure Committee or designated subgroup would review known information and develop an action plan, which would include Board outreach, expert retention, insurance notification, communication plans, and a materiality assessment.


text: While we and our IT providers employ appropriate security technologies to address the rapidly changing and evolving IT environment (including data encryption processes, intrusion detection systems), conduct comprehensive risk assessments, and other internal control procedures to assure the security of our and our customers' data, we acknowledge that no system can completely eliminate cyber attacks and the security technologies and program can provide only reasonable, assurance that these objectives will be met. Further, the design of any cybersecurity risk management program or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains despite our significant and comprehensive cybersecurity efforts. An investor should carefully consider the risks, and all other information set forth in this Annual Report on Form 10-K, including disclosures in Part I - Item 1A—Risk Factors.


text: Risk Management and Strategy Our cybersecurity risk management program is a significant part of our overall risk management program. Teams of internal and third-party cybersecurity professionals oversee cybersecurity risk management, which incorporates elements of the National Institute for Standards and Technology Cybersecurity Framework.

companyName: Prime Medicine, Inc.

ticker: PRME


text: We also maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We also have a process in place to oversee and vet our third party resources, including, for critical vendors and as appropriate, through reviews of Service Organization Control Type 2 reports.


text: We maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.


text: Although we have not experienced a material cybersecurity incident, like other organizations in our industry, we face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors — Risks Related to Information Technology and Data Privacy".


text: Oversight and Governance Members of our senior management, including our Chief Executive Officer, Chief Financial Officer, and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions. Our Head of Information Technology has approximately 20 years of information security experience.


text: Cybersecurity risk governance has been delegated by our Board of Directors to the Audit Committee of the Board of Directors, or the Audit Committee. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing, assessing, and considering, in consultation with management and the Board, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.


text: CBIZ's Vice President, IT Security and Compliance reports to CBIZ's Chief Information Officer and is the head of the Company's cybersecurity team. The IT Security Director is responsible for assessing and managing CBIZ's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes. Additionally, members of the cyber security team have extensive information technology and program management expertise and have earned various cybersecurity certifications. Finally, the cybersecurity team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by CBIZ.

companyName: CBIZ, Inc.

ticker: CBZ


text: CBIZ faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations or cash flows. CBIZ has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on CBIZ's business, financial condition, results of operations or cash flows. See "Risk Factors – Risk Factors Related to Our Business and Industry – Cyberattacks or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business."


text: Risk Management and Strategy The Company maintains an Information Security Program to safeguard all WSFS information assets against unauthorized use, disclosure, modification, damage, or loss. Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will: • Ensure the security and confidentiality of client and bank records covered by law. • Protect against any anticipated threats or hazards to the security of such records. • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Clients, and Associates. • Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements. • Ensure proper and effective Business Continuity and Disaster Recovery programs are implemented and tested.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: The Company's Cybersecurity Committee is responsible for providing overall direction to reduce risk to company and Client data that resides in various systems, both in-house and with third parties. The committee duties are to ensure the confidentiality, integrity, and availability of such information. Further, the Cybersecurity Committee is responsible for (1) prioritization of Enterprise Strategic Planning for cybersecurity, (2) the review and approval corporate cybersecurity risk tolerance, (3) monitoring of cybersecurity threats and trends, (4) support of cross-functional collaboration on cybersecurity activities, and (5) promotion and support of cybersecurity awareness and decisions across the enterprise.


text: The CISO reports security related incidents, findings, changes, etc. to the Risk Committee, on an annual basis or quarterly as needed. This information is communicated through the Company's Risk Department. The CISO has more than 25 years of experience in the information security field, including 23 years at WSFS, and holds several professional certifications and memberships in the Information Security, IT, and financial services fields.


text: The Company has dedicated incident management and response teams in place to facilitate response protocols and execute designed strategies necessary to mitigate business risk and support recovery initiatives. The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs. An Incident Response Task Force (IRTF) is in place to oversee the assessment of cybersecurity incidents and operational response needs. The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.


text: We maintain a Corporate Incident Response Plan ("CIRP") that provides a documented set of protocols for responding to actual or potential cybersecurity incidents, including timely detection and analysis, containment and elimination, and recovery and improvement following an incident. The CIRP provides for notification of appropriate information breach or cybersecurity incidents and escalation to the Company's appointed Incident Management Team, which would be composed of an Incident Response Lead and team members from information technology, information security, enterprise risk management, corporate security, compliance, and legal teams, among others. The Incident Management Team would leverage the expertise of team members to work together to respond to the incident and take appropriate measures. The Senior Risk Committee would oversee the team and receive quarterly reporting on the incident and any relevant updates. The CIRP is coordinated through Incident Management Teams that involve the Bank's Incident Management Lead, Chief Digital & Innovation Officer, Chief Information Security Officer, and other key departments. The CIRP facilitates coordination across multiple parts of our organization and is evaluated by the Chief Risk Officer and legal department at least annually.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: We assess, identify and manage risks from cybersecurity threats through our Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors (the "Audit Committee") and is managed by our Chief Information Officer ("CIO") and a dedicated Chief Information Security Officer ("CISO"). The CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network, and, information assets. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial N.V.

ticker: CNH


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2024. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the CIO and CISO. In addition, on at least an annual basis, the Board receives reports, summaries or presentations from our CIO and CISO related to cybersecurity threats, risk, mitigation and related processes.


text: The CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: Butterfly Network, Inc. uses, stores, and processes data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Risk Management Strategy and Governance Under the ultimate direction of our Chief Executive Officer, our Information Security Committee has primary responsibility for overseeing our management of cybersecurity risks. It is chaired by our Chief Information Security Officer ("CISO") who reports directly to our Chief Technology Officer. Other members of the committee include representation from information technology, quality, product, operations, sales, and compliance as well as advisory support from internal audit.


text: Our CISO, working with his team and the Information Security Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. The current CISO has more than 20 years of experience in building and leading security, risk management, and compliance organizations across several industries, including med-tech, healthcare, and financial services, and many of these companies include highly-regulated Fortune 500 companies. The current CISO is an expert in NIST 800-53 (Rev-5), ISO 27001, and other national and international security risk management disciplines.


text: The Information Security Committee meets periodically and as circumstances warrant to discuss and monitor prevention, detection, and remediation of risks from cybersecurity threats. When appropriate, cyber or information security incidents would be escalated by the CISO to our executive leadership team and/or our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Audit Committee of the Board of Directors. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing reports on data management, security initiatives, significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.


text: Our CISO meets at least quarterly with the Audit Committee of the Board of Directors to discuss management's ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation, and current developments in the cybersecurity landscape. In turn, the Chair of the Audit Committee provides a readout to the full Board of Directors that includes a summary of the CISO's presentation to enable discussion of cybersecurity risk management at the full board level.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see Part I, Item 1A "Risk Factors."


text: Processes for the Identification of Cybersecurity Threats Our Information Security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the Company to understand the severity and the likelihood of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The Information Security team has processes designed to keep the Company apprised of the different threats in the cybersecurity landscape – this includes intelligence networks alerts, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items, and attending security conferences. The team also regularly monitors our internal network and our customer-facing network to identify security risks. In addition, the team has completed several assessments and threat modeling tabletop exercises, based on "what-if" scenarios.


text: We have a mandatory employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Security training is required upon hire for new employees, and on an annual basis for the rest of the workforce.


text: As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct vendor risk assessments. To assess the effectiveness of our program, we also have engaged consultants to conduct penetration testing and other vulnerability assessment.


text: Before purchasing third-party technology or other solutions that involve exposure to the Company's assets and electronic information, our Information Technology group requires those companies to complete a security review before being approved to work with the Company. We utilize an external tool to manage critical vendors. Vendors are assessed to determine inherent and residual risk. Annually, the security team conducts a risk assessment that is informed by industry standards.


text: The Risk Assessment consists of: • Listing the vulnerabilities company assets are exposed to; • Identifying the threats that may exploit such vulnerabilities; • Calculating inherent risk rating based on impact and exploitability; and • Calculating residual risk by assessing mitigating controls.


text: We have a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Our cybersecurity risk management program includes the following: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors–Risks Related to Our Stores and Operations–We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience, and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: We are able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, our designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The Audit Committee oversees required disclosures in the event of a cybersecurity breach.


text: As part of our board refreshment efforts in recent years, we have added directors with information technology governance skills. Currently, five members of our Board have cybersecurity experience from their principal occupation, other professional experience or third-party director education courses on cybersecurity, including cyber risk governance, and data privacy and security issues and trends.


text: HHH's Board of Directors' Technology Committee governs and oversees HHH's cybersecurity program. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the HHH Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform HHH's Board of Directors on important matters. Furthermore, HHH's Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.

companyName: Howard Hughes Corp


text: Cybersecurity Program Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes designed to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security ("GIS") team has day-to-day responsibility for Spirit's cybersecurity program. This group is led by our Chief Information Security Officer ("CISO"), who has more than twenty years of relevant audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Executive Security Council comprised of senior leaders across the business meets regularly to discuss the company's overall cybersecurity strategy, policies, and key cyber risks and mitigations. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to help protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.


text: As part of our cybersecurity risk management program, we have planned "tabletop" exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive leaders. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises for all employees monthly and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents.


text: Part of our Enterprise Risk Management program involves understanding risks that third parties, including our supply chain partners, introduce to our organization. Our GIS organization has a formal risk assessment process that evaluates the cybersecurity risk of third party "as-a-service" providers, particularly in situations where we share confidential or sensitive information, or in situations where our compliance status or operations may be impacted through a cybersecurity incident.


text: Cybersecurity Governance The Board of Directors' Risk Committee has the responsibility for oversight of our cybersecurity program. This committee's membership includes subject matter experts in both cybersecurity and national security. Spirit's CISO reports to the Risk Committee quarterly or as needed on the state of our cybersecurity program.


text: Cybersecurity Risks To date, we are not aware of risks from cybersecurity threats, including as a result of any previous known cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks, and we have experienced cyber-attacks, and routinely experience cybersecurity threats and attempts to gain access to sensitive information, as do our customers, suppliers, and other third parties with which we work. We cannot provide assurance that our processes and procedures will be sufficient to anticipate, detect, recognize or prevent cybersecurity threats. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors – Risks Related to Our Operations"


text: Cybersecurity Governance Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we may take seeking to mitigate and address those cybersecurity risks. The position of Chief Information Officer (CIO), which is currently vacant, leads our cybersecurity initiatives, managing a dedicated cybersecurity team focused on implementing and overseeing a robust cybersecurity program. The cybersecurity team has related academic degrees, certifications, and real-world experience in managing cybersecurity incidents and risks. The cybersecurity program emphasizes proactive prevention, detection, mitigation, and remediation of potential cybersecurity incidents. To promote transparency and informed decision-making, the CIO and cybersecurity team provide periodic updates regarding cybersecurity risks and initiatives to both our Cyber Incident Response Steering Committee and the Board of Directors. This ensures alignment and clarity among all stakeholders concerning our cybersecurity posture. By nurturing collaboration between our board, executive leadership, and cybersecurity professionals, we are devoted to protecting our digital assets and maintaining stakeholder trust. Our commitment to enhancing our cybersecurity framework equips FAT Brands to effectively address the dynamic threat landscape.

companyName: Fat Brands, Inc

ticker: FATAQ


text: Cybersecurity Governance Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we may take to mitigate and address those cybersecurity risks. Our Vice President of Information Technology ("VP of IT") who has over 30 years of experience in technology leads our cybersecurity initiatives and oversees a team of professionals responsible for executing and managing our cybersecurity program. This program emphasizes proactive prevention, detection, mitigation and remediation of potential cybersecurity incidents. To maintain transparency and facilitate informed decision making, our VP of IT and cybersecurity team provide periodic updates on the status of cybersecurity risks and initiatives. These updates are communicated to the Board of Directors, in order to ensure that they remain informed about our cybersecurity posture. By promoting collaboration among our Board of Directors, executive leadership and cybersecurity experts, we are committed to protecting our digital assets and fostering stakeholder trust. Our continuous efforts to enhance our cybersecurity framework enable Twin Hospitality Group Inc. to effectively respond to the evolving threat landscape.

companyName: Twin Hospitality Group Inc.

ticker: TWNPQ


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity. "


text: Cybersecurity Risk Management and Strategy We have designed and maintain a cybersecurity risk management program that is integrated into our overall enterprise risk management program and with other related functions, such as information technology, or IT, system architecture and vendor management; that leverages best practices and standards and that is designed to assess, identify and manage risks from cybersecurity and other information security threats. As part of this program, we periodically evaluate risks from cybersecurity threats as part of our broader risk management activities and as a component of our internal control system. In the course of our evaluation, we consider risks that may be associated both with our internally managed IT systems and key business functions and with sensitive data operated or managed by third-party service providers, vendors and collaborators with whom we engage.

companyName: Mersana Therapeutics, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • dedicated personnel principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the conduct of regular exercises and tests of our own systems to help discover potential vulnerabilities; • the use of external service providers, where appropriate, overseen by our IT team, to assist with assessing our systems; monitoring cybersecurity threats, including the proactive identification of vulnerabilities in our systems with threat intelligence, and our defenses against cyberattacks;and providing timely cybersecurity threat alerts; • new-hire, annual and ad hoc cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan, or the Response Plan, that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process, overseen by our IT team, for key service providers, vendors and collaborators, including a due diligence process that involves the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.


text: Our Response Plan sets forth our response protocol for cybersecurity threats and cybersecurity events and incidents and is maintained by our cybersecurity incident response team, or CSIRT, which reviews the Response Plan on at least an annual basis. The CSIRT is comprised of IT department leaders, under the supervision of our Vice President, Chief Accounting Officer, who reports to our Senior Vice President, Chief Operating Officer and Chief Financial Officer, as well as members of our executive team and other senior management. Our Response Plan is designed to provide a framework for how we identify, evaluate, escalate, respond and recover in the event of a data security breach and designates personnel who are responsible for these functions. Our IT team, utilizing the support of external vendors and software products, evaluates security alerts received from various sources, and any alert or threat that the CSIRT identifies as a cybersecurity incident is promptly evaluated and escalated in accordance with the Response Plan for further assessment. Upon confirmation that a cybersecurity incident has occurred, our CSIRT will establish an incident response team, which may include representatives from our internal departments, as well as internal or external legal counsel or other external cybersecurity consultants or service providers. The CSIRT aims to develop a coordinated response strategy, including with respect to risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition to date. However, we, our collaborators and our third-party vendors and service providers may in the future be the target of cybersecurity threats, any of which could have a material adverse effect on our business. For a description of the cybersecurity risks we face and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance and Oversight Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program, using outside specialists where deemed necessary.


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from our executive team, informed by our Vice President, Chief Accounting Officer, on our cybersecurity risk management program, on a periodic basis.


text: Our executive team, including our Senior Vice President, Chief Operating Officer and Chief Financial Officer and our Senior Vice President, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The executive team has primary responsibility for our overall cybersecurity risk management program. Our Senior Vice President, Chief Operating Officer and Chief Financial Officer supervises our Vice President, Chief Accounting Officer, who leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our internal cybersecurity personnel and retained external cybersecurity advisors to address cybersecurity risks. Our Vice President, Chief Accounting Officer and the internal cybersecurity personnel under his supervision collectively have experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals, such as pharmaceuticals/biotechnology, technology, telecommunications and financial services, and hold several related third-party certifications related to information systems management and security.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating in these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains regular contact with the Federal Bureau of Investigation for sharing of threat information.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant program delays and reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We are susceptible to a security breach, through cyber-attack, cyber-intrusion, insider threats or otherwise, and to other significant disruptions of our IT networks and related systems, or those of our customers, suppliers, vendors, subcontractors, partners, or other third parties" in this Annual Report.


text: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program on information security. He is also responsible for keeping HGV apprised of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with currently recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the Eastern U.S. region and the other in the Western U.S. region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations in East Asia, the Western U.S. and the South Central U.S. regions. Replicated instances of this technology are maintained in our Eastern U.S. region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Risks Related to Our Business—Risks Related to Our IT Systems and Cybersecurity" in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and data. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including ISO 27001, as a guide to help us identify, detect, assess, and manage reasonably foreseeable cybersecurity risks and threats relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify reasonably foreseeable material risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from reasonably foreseeable cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify, detect, assess and manage reasonably foreseeable cybersecurity threats associated with our use of key third-party service providers, suppliers and vendors with respect to our critical systems and data based on our assessment of how critical they are to our operations and respective risk profile.


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risk from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks, including the oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks. In addition, management updates the Audit Committee, when it deems appropriate, regarding cybersecurity incidents it considers to be significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies; and alerts and reports produced by security tools deployed in our IT environment. In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.

companyName: BGC Group, Inc.

ticker: BGC


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public and private financial services companies, beginning in December 2024, our global CIO, whose experience includes approximately 40 years of service in financial services and technology, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of our company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for our cybersecurity program and is a key member of the risk management function, reporting directly to the Chief Risk Officer ("CRO") and to the Enterprise Risk Committee of our Board of Directors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements: • Systems Safeguards. We adopt the "trust by design" framework when designing new products, services and technology. We employ a variety of administrative, preventative and detective controls and tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. • Incident Response. We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. • Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness. • Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber-attacks, and recovery and resilience tests. • Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber-attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled "We are subject to certain risks in connection with our use of technology."


text: The Information Technology and Information Security sub-committee is a sub-committee of the management level Enterprise Risk Management Committee and is represented by managers within various departments and includes the CISO, the Chief Technology Officer ("CTO"), and the Chief Information Officer ("CIO") and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO, CIO, and CTO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity events encountered by the Company and known events encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 25 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company.


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner. Our security operations team ("SOT"), which is comprised of internal security professionals and reports to the Chief Information Officer ("CIO"), has first line responsibility for our cybersecurity risk management processes as they relate to day-to-day operations. Our audit and compliance team ("ACT"), which is comprised of a team lead and the CIO, has second line responsibility and works in partnership with our executive leadership team ("ELT") and other internal teams to coordinate efforts, priorities and oversight. Our ACT assesses cybersecurity threats and risks based on probability and potential impact to key business systems and processes. Threats and risks that can cause major damage or service impact that the ACT considers high are incorporated into our overall risk management program. The ACT develops a mitigation plan for each identified high threat and risk and reports its progress with respect to mitigation of such threats and risks to the Technology Risk Management Committee, which is part of our ELT and consists of both management-level employees and members of the Board; such high-level cybersecurity threats and risks are tracked as part of our overall risk management program.

companyName: QXO, Inc.

ticker: QXO