text: Cybersecurity Risk Management and Strategy We recognize cybersecurity as a critical aspect of our overall risk management program and are committed to maintaining a cybersecurity program to protect our information assets, systems, and operations. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risks areas. We continuously evaluate and enhance our cybersecurity program based on lessons learned, industry best practices and feedback from internal and external stakeholders.

companyName: DIXIE GROUP INC

ticker: DXYN


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify, prioritize and mitigate potential material cybersecurity risks to our critical systems and information; • an internal Information Technology staff responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our associates, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors.

secItem: Item 1C


text: We did not experience a material cybersecurity incident during the year ended December 30, 2023; however, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Cybersecurity Governance Our Board of Directors (the "Board") has oversight responsibility for cybersecurity risk management. The Board oversees management's ongoing activities related to our cybersecurity risk management program. The management team is responsible for the implementation and execution of our cybersecurity program. In addition, the management team provides guidance and direction on cybersecurity priorities, resource allocation and risk tolerance levels. The Board receives quarterly updates from the management team on cybersecurity matters.


text: We did not experience a material cybersecurity incident during the year ended December 28, 2024; however, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Cybersecurity Strategy and Risk Management Donaldson recognizes the critical importance of cybersecurity. Protecting the confidentiality, integrity and availability of our data, we focus on building resilience into the very fabric of our enterprise digital ecosystem. Our cybersecurity program is comprehensively integrated within our enterprise risk management and encompasses the enterprise information technology (IT) and operational technology (OT) environments. Our cyber risk management program controls are based on industry-recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO) 27001 information security management system requirements.

companyName: DONALDSON Co INC

ticker: DCI


text: Technical safeguards – We seek to maintain an information technology infrastructure that implements risk-based physical, administrative and technical controls to safeguard our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information.


text: Cybersecurity incident response plan and testing – We perform 24x7 security monitoring and execute a cybersecurity incident response plan with a dedicated team to respond to cybersecurity incidents. When a potential material cybersecurity incident is identified, we deploy cross-functional teams responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams prioritize responses to incidents depending on severity levels. We continuously improve our cybersecurity incident management plan through periodic tabletop exercises or simulations at the enterprise and business levels.


text: Education and Awareness – We require annual training for personnel for information security, including information about the latest cybersecurity threats. To equip employees with the knowledge to identify potential risks with tools to report any suspicious activities, we implemented monthly phishing exercises that encompass various real-life simulations. We also practice scenario-based simulation drills, such as tabletop exercises for employees and contractors, to enhance awareness and vigilance of potential threats. For fast-developing threat situations, we utilize enterprise-wide corporate communication channels to broadcast security alerts for the timely delivery of important information to our employees.


text: Technology managed by third parties – We have IT systems essential to business operations managed by third parties. These systems process, transmit, store electronic information and manage or support a variety of business processes and activities. Before any engagement, we conduct holistic risk assessments of third-party providers. We scrutinize multiple dimensions of risk factors including information security, regulatory compliance and architectural design. We established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Third-party assessments of the Company – We regularly engage third-party consultants, legal advisors and audit firms in evaluating and testing our risk management processes, compliance with international standards and regulations, and assessing potential cybersecurity threats, as appropriate. Any recommendations are tracked with senior IT ownership and timelines for remediation.


text: We consider cyber risks among the top risks for us within our enterprise risk management framework. This framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, and that are required to be reported in this Form 10-K. We do not believe we have experienced any risks from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy or our results of operations or financial condition, including for any of the three years ended July 31, 2024, 2023 or 2022. For further discussion of the risks associated with cybersecurity incidents, refer to the cybersecurity risk factors in Item 1A, "Risk Factors" in this Form 10-K.


text: Cybersecurity Governance Our board of directors has oversight of overall risk management, prioritizing the most significant risks including strategic, operational, financial and legal compliance risks. The board's risk oversight process builds upon management's risk management processes, which include processes for identifying, assessing and managing material risks from cybersecurity threats. The board implements its risk oversight function primarily through its audit committee, which receives reports about our practices, programs, notable threats or incidents, and other developments related to cybersecurity throughout the year. To this extent, the audit committee receives information about cybersecurity risks as part of our enterprise risk management framework and reporting. The audit committee then assesses implemented cybersecurity controls to monitor and evaluate the mitigation of cybersecurity risks.


text: Our Chief Information Officer (CIO) provides annual reports, with additional updates as necessary to the board of directors. Our CIO also attends annual audit committee meetings and provides cybersecurity updates which include specific cybersecurity topics, covering material risks and threats. Our CIO oversees the cybersecurity program. With an extensive background in the IT industry, our CIO has previously been in multiple CIO positions and other top global leadership roles that drove digital transformation and owned technology from end to end. Our CIO leads a cross-functional information security team, comprised of experienced professionals from the global infrastructure and cybersecurity, legal and compliance organizations. Beyond information technology, this leadership team also partners with our Enterprise Operations team managing the operational technology security of our manufacturing facilities.


text: We consider cyber risks among the top risks for us within our enterprise risk management framework. This framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, and that are required to be reported in this Form 10-K. We do not believe we have experienced any risks from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy or our results of operations or financial condition, including for any of the three years ended July 31, 2025, 2024 or 2023. For further discussion of the risks associated with cybersecurity incidents, refer to the cybersecurity risk factors in Item 1A, "Risk Factors" in this Form 10-K.


text: Our Chief Information Officer (CIO) provides annual reports, with additional updates as necessary to the board of directors. Our CIO also attends annual audit committee meetings and provides cybersecurity updates which include specific cybersecurity topics, covering material risks and threats. Our CIO oversees the cybersecurity program. With an extensive background in the IT industry, our CIO has previously held CISO positions, and other top global leadership roles, that drove digital transformation and owned technology from end to end. Our CIO leads a cross-functional information security team, comprised of experienced professionals from the global infrastructure and cybersecurity, legal and compliance organizations. Beyond information technology, this leadership team also partners with our Enterprise Operations team managing the operational technology security of our manufacturing facilities.


text: Risk Management and Strategy We continue to face significant and persistent cybersecurity risks and our business has both an increasing reliance on systems and an increasing digital footprint as a result of changing technologies, connected devices and digital offerings, as well as expanded remote work policies. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and have a team of security personnel managing our efforts and initiatives. We regularly review our policies, practices, and plans with assistance from third party experts and advisors for certification purposes, including with respect to System and Organization Controls 2 (SOC 2) certifications and Payment Card Industry Data Security Standard (PCI-DSS) certifications where relevant, and leverage third party resources to support our cyber risk defense, monitoring and response processes. We conduct security assessments and periodic re-assessments on third party partners and other service providers with access to information assets of Dover. In addition, we review independent audit reports from key third party partners and other service providers with access to information assets at least annually.

companyName: DOVER Corp

ticker: DOV


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also integrate security measures into our digital products and services.


text: Our product security efforts are informed in part by industry security standards such as ISA 62443, UL 2000-1, and certain standards from the National Institute of Standards & Technology ("NIST"). As part of our efforts, we conduct risk assessments and prioritize security validation for certain of our products. For example, we conduct security testing and remediation on a risk-based prioritized basis prior to releasing certain products into the market, as well as periodically post-release to discover potential issues in code, firmware, and protocols and to consider potential security patches or future version updates. We have received SOC 2 certifications for some of our products and software offerings and continue to strive to meet similar requirements for other digital offerings.


text: Our enterprise risk management program, led by a team of senior executives, includes the performance of an annual risk assessment made at the corporate center and operating company levels, and is designed to identify enterprise level risks we may face, including cybersecurity risk at a high level. Each quarter, this team reassesses the identified enterprise risks, the severity of these risks, and the status of efforts to mitigate them. We also engage consultants and other third parties for periodic risk and vulnerability testing and assessment. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cyber security threats, please see the risk factor titled, "Our operations, businesses, products, and business strategy are subject to cybersecurity risks,"in Item 1A. "Risk Factors."


text: Our Board has established a risk management process to identify and manage material risks at the enterprise level, including the potential impact of key cybersecurity threats. The full Board meets with the Senior Vice President & Chief Digital Officer (CDO) and our Chief Information Security Officer (CISO) on at least an annual basis to discuss our cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities.


text: Our CDO and CISO work to protect the Company's information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with the Company's cybersecurity incident response and recovery plans and processes as described above. The CDO is responsible for corporate-wide data security, and the CISO is responsible for developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The CDO and CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity incident response and recovery plans and processes, as described above. The CDO and CISO also periodically meet with certain corporate officers, such as the Company's Chief Financial Officer and General Counsel to review and discuss cybersecurity issues.


text: The CDO has over 30 years of information technology experience, including at several Fortune 500 companies and including experience with cybersecurity initiatives that address governance, operational practices, cyber-awareness and technology. The CISO has over two decades of information technology risk management experience, including experience with information security testing at several Fortune 500 companies. The CDO holds an undergraduate degree in electrical and electronics engineering, a master's degree in computer science and a master's degree in business administration, and the CISO holds an undergraduate degree in electrical and computer engineering.


text: The CDO and CISO annually brief our full Board of Directors on enterprise-wide cybersecurity risk management and our overall cybersecurity risk environment.


text: Risk Management and Strategy We continue to face significant and persistent cybersecurity risks and our business has both an increasing reliance on systems and an increasing digital footprint as a result of changing technologies, connected devices and digital offerings, as well as expanded remote work policies. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, take steps to ensure maintenance of backup and protective systems, and have a team of security personnel managing our efforts and initiatives. We regularly review our policies, practices, and plans with assistance from third party experts and advisors for certification purposes, including with respect to SOC 2 certifications and Payment Card Industry Data Security Standard (PCI-DSS) certifications where relevant, and leverage third party resources to support our cyber risk defense, monitoring and response processes. We conduct security assessments and periodic re-assessments on key third party partners and other service providers with access to information assets of Dover. We review independent audit reports from key third party partners and other service providers with access to information assets at least annually. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually.


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that has in the past led to and may in the future lead to exploits, security breaches and service disruption. We also integrate security measures into our digital products and services, although product security risks will continue to evolve and grow more complex.


text: Our product security efforts are informed in part by key tenants of various industry security standards such as ISA 62443, UL 2000-1, and certain standards from the National Institute of Standards & Technology ("NIST"). As part of our efforts, we conduct risk assessments and prioritize security validation for certain of our products. For example, we conduct security testing and remediation on a risk-based prioritized basis prior to releasing certain products into the market, as well as periodically post-release to discover potential issues in code, firmware, and protocols and to consider potential security patches or future version updates. We have received SOC 2 certifications for some of our products and software offerings and continue to strive to meet similar requirements for other digital offerings.


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any specific risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cyber security threats, please see the risk factor titled, "Our operations, businesses, products, and business strategy are subject to cybersecurity risks,"in Item 1A. "Risk Factors."


text: Our CDO and CISO work to protect the Company's information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with the Company's cybersecurity incident response and recovery plans and processes as described above. The CDO is responsible for corporate-wide data security, and the CISO is responsible for developing, implementing and enforcing security policies at the corporate level and providing guidance for the operating companies to manage our overall cybersecurity risks. The CDO and CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity incident response and recovery plans and processes, as described above. The CDO and CISO also periodically meet with certain corporate officers, such as the Company's Chief Financial Officer and General Counsel to review and discuss cybersecurity issues.


text: The CDO has over 30 years of information technology experience, including at several Fortune 500 companies and including experience with cybersecurity initiatives that address governance, operational practices, cyber-awareness and technology. The CISO has over 25 years of cybersecurity and risk management experience, specializing in strategy, architecture, and operational practices at multiple Fortune 500 companies. The CDO holds an undergraduate degree in electrical and electronics engineering, a master's degree in computer science and a master's degree in business administration. The CISO holds an undergraduate degree in political science and a master's degree in information security, along with Certified Information Systems Security Professional (CISSP) and Information Systems Security Management Professional (ISSMP) certifications.


text: Risk Management and Strategy Dow has processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Corporation. These processes are part of Dow's overall enterprise risk management process and have been embedded in Dow's operating procedures, internal controls and information systems.

companyName: UNION CARBIDE CORP /NEW/


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.


text: Dow contracts with external firms to assess Dow's cyber security controls relative to its peers using the NIST CSF. Dow also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, Dow maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: Dow has established cybersecurity and information security awareness training programs. Formal training on topics relating to Dow's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to Dow's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Dow company-wide communications with frequent updates to educate on the latest adversary trends and social engineering techniques.


text: Additionally, Dow engages in cyber crisis response simulations to assess Dow's ability to adapt to information and operational technology threats. Improper or illegitimate use of Dow's information system resources or violation of Dow's information security policies and procedures is subject to disciplinary action. Dow's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.


text: Dow also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate Dow's security posture. Dow also engages external firms to measure Dow's NIST CSF maturity level.


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Corporation, including its business strategy, results of operations or financial condition.


text: Role of Management Dow's Information Systems organization led by Dow's Chief Information and Digital Officer, is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by Dow's Audit Committee.


text: Dow's Chief Information and Digital Officer has formal education in information technology and extensive experience working in and leading Dow's information systems and technology function. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: Dow management responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant industry experience in security related industries. Additionally, leaders in Dow's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: Dow's Cyber Security Operations Center ("CSOC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or Dow internal information systems and incidents originating from third parties. The CSOC provides end-to-end operations for purposes of monitoring, detecting, alerting and responding to cyber incidents. The CSOC evaluates each incident in terms of its impact on Dow's and the Corporation's operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. The CSOC is also responsible for activating the containment and resolution efforts and third-party service providers are engaged where appropriate to support Dow through the resolution of the incident. The CSOC escalates incidents with significant impact and pervasiveness to Dow's Corporate Crisis Management Team for further action. After initial identification, the CSOC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Corporation's Board The Corporation's Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the Corporation's sensitive data. The Board is responsible for overseeing overall risk management for the Corporation, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk.


text: The Corporation's Board receives information and updates periodically with respect to the effectiveness of Dow's cybersecurity and information security framework, data privacy and risk management, which includes that of the Corporation. The Board also receives updates on material incidents relating to information systems security, including cybersecurity incidents.


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls. In addition, Dow maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: Dow has comprehensive processes to manage cybersecurity risks when engaging with third-party service providers, including reviewing questionnaires and independent quantitative scores of the vendor's cyber hygiene, maintaining robust controls to address and mitigate significant risks that may arise, and performing ongoing assessments and reviews throughout the duration of the engagement.


text: As of the date of this report, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Corporation, including its business strategy, results of operations or financial condition. Although the Corporation has mature processes in place to identify and mitigate potential risks from cybersecurity threats, such risks cannot be completely eliminated. More information on the risks of cybersecurity threats and potential impact to the Corporation can be found in Item 1A. Risk Factors.


text: Role of Management Dow's Information Systems organization is led by Dow's Chief Information and Digital Officer, who reports to Dow's Chief Operating Officer, and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by the Dow Inc. Audit Committee.


text: Dow's Chief Information and Digital Officer has formal education in information technology and more than 30 years of experience in information systems and technology, including as the vice president of Global Information Technology. Prior to joining Dow, the Chief Information and Digital Officer held a variety of leadership roles including vice president of Information Technology at Cargill, Incorporated. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: Dow management responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant experience in security related industries. Additionally, leaders in Dow's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: We use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the ISO 27001 framework as published by the International Organization for Standardization as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. We have designed and assessed our program based on the NIST CSF and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • an internal security staff principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors, including cloud-related service providers.


text: While we have experienced cybersecurity incidents that resulted in the disruption of our information technology systems and required us to engage third parties to remediate the issues, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, results of operations, or financial position. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, results of operations and financial position. See Item 1A "Risk Factors - We rely extensively on information technology systems, and cybersecurity incidents could adversely affect us."


text: Cybersecurity Governance Our Board of Directors, or Board, considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer, or CIO, Chief Information Security Officer, or CISO, and Chief Information Risk Officer, or CIRO, and other security staff as part of the Board's continuing education on topics that impact the Company.


text: Our management team, including our CIO, CISO and CIRO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity advisors. Our Information Technology (IT) management team collectively hold over 50 years of strategic IT and global transformational experience, including having held IT advisory roles with top-tier organizations. Each member of the team has experience operating in complex, international business environments. The IT management team has demonstrated achievement in Information Security strategy development, risk management and implementation of security and risk management programs that drive awareness, decrease exposure and strengthen organizational IT controls.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program; and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: While we have experienced cybersecurity incidents that resulted in the disruption of our information technology systems and required us to engage third parties to remediate the issues, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, results of operations and financial condition. See Item 1A, "Risk Factors - We rely extensively on information technology systems, and cybersecurity incidents could adversely affect us."


text: Our management team, including our CIO, CISO and CIRO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity advisors. Our Information Technology (IT) management team collectively holds over 50 years of strategic IT and global transformational experience, including having held IT advisory roles with top-tier organizations. Each member of the team has experience operating in complex, international business environments. The IT management team has demonstrated achievement in Information Security strategy development, risk management and implementation of security and risk management programs that drive awareness, decrease exposure and strengthen organizational IT controls.


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Finance and Risk Committee of our Board of Directors. The Finance and Risk Committee receives regular reports from management, including our Chief Information Officer (CIO), and reports to the Board of Directors at least annually on data protection and cybersecurity matters and reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to regularly scheduled Finance and Risk Committee reviews, we have in place processes and protocols by which certain cybersecurity incidents are reported immediately to the Company's executive leadership team, and subsequently thereafter, as appropriate to the Finance and Risk Committee.

companyName: FLOWSERVE CORP

ticker: FLS


text: Our CIO and our Director of Cybersecurity, who reports in to the CIO, have extensive cybersecurity knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, respectively, and head the team responsible for implementing and maintaining cybersecurity and data protection practices across our business. Reporting to our Chief Information Officer and Director of Cybersecurity are a number of experienced information security specialists responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. The CIO and Director of Cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from this team and regularly review risk management measures implemented by the Company to identify and mitigate cyber security risks. The CIO also attends regular meetings of the Finance and Risk Committee to report information on material risks from cybersecurity threats.


text: Risk Management and Strategy We have documented processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that may result in adverse effects on the confidentiality, integrity, and availability of our information systems and the information residing therein. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data we collect, process, store, and transmit as part of our business. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor or customer.


text: As part of our risk management process and compliance with our ISO 27001 cybersecurity certification requirements, we conduct penetration testing, security audits, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems, to undertake data protection and cybersecurity training and compliance programs as part of the employee onboarding process, as well as annually thereafter. In addition to our in-house cybersecurity capabilities, we engage consultants and other third parties as necessary to assist with assessing, identifying, and managing cybersecurity risks. With respect to incident response, we have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides governance and guidance in responding to cybersecurity incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the CIRP aligns with the ISO 27001 standard. The CIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by our Board of Directors. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful incidents. For additional information on cybersecurity risks we face, see "Item 1A. Risk Factors", of this Annual Report, which should be read in conjunction with the foregoing information.


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Technology, Risk and Finance Committee of our Board of Directors. The Technology, Risk and Finance Committee receives regular reports from management, including our Chief Information Officer (CIO), and reports to the Board of Directors at least annually on data protection and cybersecurity matters and reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to regularly scheduled Technology, Risk and Finance Committee reviews, we have in place processes and protocols by which certain cybersecurity incidents are reported immediately to the Company's executive leadership team, and subsequently thereafter, as appropriate to the Technology, Risk and Finance Committee.


text: Our CIO and our Director of Cybersecurity, who reports in to the CIO, have extensive cybersecurity knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, respectively, and head the team responsible for implementing and maintaining cybersecurity and data protection practices across our business. Reporting to our CIO and Director of Cybersecurity are a number of experienced information security specialists responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. The CIO and Director of Cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from this team and regularly review risk management measures implemented by the Company to identify and mitigate cyber security risks. The CIO also attends regular meetings of the Technology, Risk and Finance Committee to report information on material risks from cybersecurity threats.


text: As part of our risk management process and compliance with our ISO 27001 cybersecurity certification requirements, we conduct penetration testing, security audits, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems, to undertake data protection and cybersecurity training and compliance programs as part of the employee onboarding process, as well as annually thereafter. In addition to our in-house cybersecurity capabilities, we engage consultants and other third parties as necessary to assist with assessing, identifying, and managing cybersecurity risks. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides governance and guidance in responding to cybersecurity incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the CIRP aligns with the ISO 27001 standard. The CIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by our Board of Directors. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future incidents. For additional information on cybersecurity risks we face, see "Item 1A. Risk Factors", of this Annual Report, which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy Wendy's is committed to securing our information systems against cybersecurity threats and protecting the privacy and security of our customers', employees', franchisees' and business partners' information. However, as described in "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's interconnected digital world and that, despite devoting considerable resources to secure our information systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Based on this recognition and taking into account experience from previous cybersecurity incidents, we have developed a comprehensive cybersecurity risk management strategy designed to identify, assess and manage potential threats to our information systems. Key components of our cybersecurity risk management strategy include the following: • CIS Controls. We design our cybersecurity risk management strategy based on the Center for Internet Security's ("CIS") Critical Security Controls Framework and other industry accepted standards and practices. The CIS is an internationally recognized, non-profit organization dedicated to developing controls, benchmarks and best practices for cybersecurity risk management. We conduct an annual assessment of our progress against the CIS controls to measure our performance against accepted benchmarks and identify ways to enhance our cybersecurity risk management strategy. The results of the assessment are reviewed by our Internal Audit team and shared with senior leadership and the Technology Committee of our Board of Directors. • Regular Risk Assessments. We conduct regular risk assessments to identify and assess material risks to our information systems, including as part of our enterprise risk management ("ERM") program, which is described in more detail under "Cybersecurity Governance" below. These risk assessments involve input from key stakeholders, including those with assigned accountability for managing risk and supporting technical risk subject matter expertise, and consider a variety of factors, including our global business strategy, operations and support, information systems and data assets. • Infrastructure. We design our cybersecurity infrastructure, including firewalls, endpoint security, intrusion detection tools and identity access management systems, to provide a multi-layered approach to protecting our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. • Dedicated Personnel. We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response. In recent years, we have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions. • Training. We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices. This training program includes initial onboarding training, annual refresher training and periodic awareness assessments such as email phishing campaigns to test user awareness and defend against business email compromise.

companyName: Wendy's Co

ticker: WEN


text: • Third-Party Experts. In addition to our internal cybersecurity risk management practices, we engage third-party experts to provide independent, external assessments of our information systems and security controls. These assessments address various regulatory requirements, take into consideration internal- and external-facing information systems and include tabletop exercises and technical system reviews related to security preparedness and response capabilities. • Third-Party Service Providers. We rely on third-party service providers to support our business operations and help execute our digital, restaurant technology and enterprise technology initiatives. Our contract review and onboarding process includes assessing third-party cybersecurity risk management practices and conducting data protection impact assessments for personal data processing that may result in high risk to individuals. Annually, we also review certain third parties' information security practices for compliance with contractual and regulatory obligations. • Incident Response Plan. We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident analysis processes. The incident response plan designates an incident response team that is responsible for managing and executing response activities in coordination with subject matter experts and other stakeholders in the event of an incident. The incident response plan is supplemented by detailed incident management plans that outline the technical steps to be taken in response to certain types of incidents. We regularly conduct tabletop exercises and incident response plan testing to evaluate our incident response capabilities and readiness. • Annual Strategy Review. We annually review our cybersecurity risk management strategy to ensure it addresses changes in our business operations and the evolving cybersecurity threat landscape. This includes annual reviews of our incident response plan, as well as our information security, data classification and other Company policies and standards, reports to our Board of Directors and Board committees and detailed presentations to support the annual renewal of our system cyber insurance program. • Peer Involvement. We are active in the information security community, including as a core member of the Retail and Hospitality Information Sharing and Analysis Center ("RH-ISAC"), which represents more than 200 companies across retail and other consumer-facing industries. As a member of RH-ISAC, we benefit from real-time collaboration, industry specific benchmarking, threat intelligence reports and analysis, industry-relevant committees and working groups and numerous cybersecurity training, education and knowledge sharing opportunities. • Cybersecurity Insurance. We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company and the Wendy's system in the U.S. and Canada. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future incidents.


text: Role of the Board Our Board of Directors provides oversight with respect to our risk assessment and risk management activities, including our cybersecurity risk management strategy. While our Board has primary responsibility for risk oversight, the Board's standing committees support the Board by addressing various risks within their respective areas of responsibility.


text: The Audit Committee oversees our ERM program, which is designed to identify current and potential risks facing the Company and ensure that actions are taken as and when appropriate to manage and mitigate those risks. Cybersecurity risks are integrated into our ERM program, which includes an annual risk assessment, assignment of accountability for risk management and development of risk treatment strategies. We believe that evaluating cybersecurity risks alongside other business risks under our ERM program aligns our cybersecurity risk management strategy with the Company's broader business goals and objectives. The Audit Committee receives a comprehensive ERM report from management on a semiannual basis and discusses the results with the full Board. The Board also receives a comprehensive ERM report from management on an annual basis.


text: The Technology Committee provides oversight with respect to our technology risk management, assessment and exposures, including cybersecurity risks. The Technology Committee receives regular updates from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") regarding our cybersecurity risk management strategy, the cyber threat landscape, industry trends and other relevant cybersecurity topics. Management also provides the Technology Committee with detailed reports regarding our technology priorities and initiatives to ensure that our cybersecurity risk management strategy remains current and aligned with our overall business strategy.


text: Role of Management Our CIO defines and administers our cybersecurity risk management strategy. The CIO possesses both academic and industry experience, including leading multiple global retail and technology companies through technology implementation and modernization utilizing industry best practices. Our CISO reports to the CIO and directs, coordinates, plans and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. The CISO possesses academic and industry certifications and experience in leading and managing information security programs, modernization and risk remediation work with multiple global companies, in addition to expertise in state and federal law enforcement cyber investigations. The CISO briefs the CIO regularly on current cybersecurity matters and relevant issues across the cybersecurity threat landscape. The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk management strategy. The CIO and CISO are supported by several dedicated teams of cybersecurity specialists, including teams responsible for vulnerability and penetration assessments, secure design of systems and applications, intrusion detection and monitoring and incident response. In addition, the CIO and CISO coordinate with other internal teams, including Digital, Data Governance, Operations, Finance, Legal and Internal Audit, to ensure our cybersecurity risk management strategy supports the Company's technology strategy and overall business goals.


text: Cybersecurity Risk Management and Strategy Wendy's is committed to securing our information systems against cybersecurity threats and protecting the privacy and security of our customers', employees', franchisees' and business partners' information. However, as described in "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's interconnected digital world and that, despite devoting considerable resources to secure our information systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Based on this recognition and taking into account experience from previous cybersecurity incidents, we have developed a comprehensive cybersecurity risk management strategy designed to identify, assess and manage potential threats to our information systems. Key components of our cybersecurity risk management strategy include the following: • CIS Controls. We design our cybersecurity risk management strategy based on the Center for Internet Security's ("CIS") Critical Security Controls Framework and other industry accepted standards and practices. The CIS is an internationally recognized, non-profit organization dedicated to developing controls, benchmarks and best practices for cybersecurity risk management. We conduct an annual assessment of our progress against the CIS controls to measure our performance against accepted benchmarks and identify ways to enhance our cybersecurity risk management strategy. The results of the assessment are reviewed by our Internal Audit team and shared with senior leadership and the Technology Committee of our Board of Directors. • Regular Risk Assessments. We conduct regular risk assessments to identify and assess material risks to our information systems, including as part of our enterprise risk management ("ERM") program, which is described in more detail under "Cybersecurity Governance" below. These risk assessments involve input from key stakeholders, including those with assigned accountability for managing risk and supporting technical risk subject matter expertise, and consider a variety of factors, including our global business strategy, operations and support, information systems and data assets. • Infrastructure. We design our cybersecurity infrastructure, including firewalls, endpoint security, intrusion detection tools and identity access management systems, to provide a multi-layered approach to protecting our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. • Dedicated Personnel. We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response. We have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions. • Training. We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices. This training program includes initial onboarding training, annual refresher training and periodic awareness assessments such as email phishing campaigns to test user awareness and defend against business email compromise.


text: • Third-Party Experts. In addition to our internal cybersecurity risk management practices, we engage third-party experts to provide independent, external assessments of our information systems and security controls. These assessments address various regulatory requirements, take into consideration internal- and external-facing information systems and include tabletop exercises and technical system reviews related to security preparedness and response capabilities. • Third-Party Service Providers. We rely on third-party service providers to support our business operations and help execute our digital, restaurant technology and enterprise technology initiatives. Our contract review and onboarding process includes assessing third-party cybersecurity risk management practices and conducting data protection impact assessments for personal data processing that may result in high risk to individuals. Annually, we also review certain third parties' information security practices for compliance with contractual and regulatory obligations. • Incident Response Plan. We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident analysis processes. The incident response plan designates an incident response team that is responsible for managing and executing response activities in coordination with subject matter experts and other stakeholders in the event of an incident. The incident response plan is supplemented by detailed incident management plans that outline the technical steps to be taken in response to certain types of incidents. We regularly conduct tabletop exercises and incident response plan testing to evaluate our incident response capabilities and readiness. • Annual Strategy Review. We annually review our cybersecurity risk management strategy to ensure it addresses changes in our business operations and the evolving cybersecurity threat landscape. This includes annual reviews of our incident response plan, as well as our information security, data classification and other Company policies and standards, reports to our Board of Directors and Board committees and detailed presentations to support the annual renewal of our system cyber insurance program. • Peer Involvement. We are active in the information security community, including as a core member of the Retail and Hospitality Information Sharing and Analysis Center ("RH-ISAC"), which represents more than 200 companies across retail and other consumer-facing industries. As a member of RH-ISAC, we benefit from real-time collaboration, industry specific benchmarking, threat intelligence reports and analysis, industry-relevant committees and working groups and numerous cybersecurity training, education and knowledge sharing opportunities. • Cybersecurity Insurance. We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future incidents.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, as described above, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K.


text: Role of Management Our CIO defines and administers our cybersecurity risk management strategy. The CIO possesses both academic and industry experience, including leading multiple global retail and technology companies through technology implementation and modernization utilizing industry best practices. Our CISO reports to the CIO and directs, coordinates, plans and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. The CISO possesses academic and industry certifications and approximately two decades of experience in technology risk management, including over a decade with the Company leading multiple information security functions. The CISO briefs the CIO regularly on current cybersecurity matters and relevant issues across the cybersecurity threat landscape. The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk management strategy. The CIO and CISO are supported by several dedicated teams of cybersecurity specialists, including teams responsible for vulnerability and penetration assessments, secure design of systems and applications, intrusion detection and monitoring and incident response. In addition, the CIO and CISO coordinate with other internal teams, including Digital, Data Governance, Operations, Finance, Legal and Internal Audit, to ensure our cybersecurity risk management strategy supports the Company's technology strategy and overall business goals.


text: We have developed and maintain a Material Cyber Incident Disclosure Program. The program includes processes for the identification, review and assessment of materiality of cyber events, notification of our senior leadership and Board of Directors of such events, and financial reporting disclosure where applicable. As part of the program, we also engage in due diligence regarding the cybersecurity capabilities of our current and potential third-party vendors in accordance with industry best practices. Under the program, all material cyber incidents will be reported to our Board of Directors. The program is led by our Cyber Event Disclosure Committee, which includes members of our Information Security, Corporate Legal, External Reporting and Enterprise Risk Management teams. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. For all critical third party service provides, we perform a review of the vendor's System and Organization Controls (SOC), which is referred to as a SOC 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to understand and mitigate any additional risks. Our assessment of risks associated with use of third-party providers is part of our overall risk management framework.

companyName: REVVITY, INC.

ticker: RVTY


text: The Company's Chief Information Officer is responsible for developing and implementing our information security program. Our Information Security team monitors our exposure to external cybersecurity threats, leveraging automated tools and manual processes to ensure cybersecurity risk is effectively mitigated on a continuous basis. When a specific incident has been identified, the Information Security team leverages our Cyber Incident Response Plan in conjunction with established Information Security policies to begin assessment of the incident. Depending on the type and/or severity of the incident, our Information Security team will determine (in compliance with our Cyber Incident Response Plan) whether third party expertise or consultation is necessary. If such expertise or consultation is determined to be necessary, our Information Security and Corporate Legal teams will engage with third-party experts. As part of its review of incidents, our Information Security team considers the risk exposure, potential impact, severity and implications with respect to our information technology systems. Our Information Security team is responsible for escalating incidents which are determined to be higher risk to our Cyber Event Disclosure Committee. The Cyber Event Disclosure Committee will work with our General Counsel to determine the materiality of the incident and any required disclosure. When an incident is determined to be material and is required to be disclosed, the Cyber Event Disclosure Committee will notify our senior leadership and our Board of Directors through the Audit Committee of our Board of Directors. The Cyber Event Disclosure Committee will collaborate with our Corporate Legal and Financial Reporting teams to develop any required Form 8-K Item 1.05 disclosure.


text: The oversight, monitoring, and testing of the program occurs under our Sarbanes-Oxley entity-level control reviews and the program is integrated into our Enterprise Risk Management processes. The Cyber Event Disclosure Committee convenes, at least monthly, to review recent developments in cybersecurity and in the cybersecurity risk landscape. The Cyber Event Disclosure Committee is comprised of representatives with relevant expertise for assessing and managing the applicable risks. Our Board of Directors is presented with updates on an annual, or as needed, basis regarding our cybersecurity preparedness. Additionally, our Board of Directors is provided with a comprehensive cyber training from our Chief Information Security Officer at least annually. Our Board of Directors annually reviews our cybersecurity program and the Audit Committee of our Board of Directors is specifically responsible for oversight of cybersecurity risk, which it regularly reviews with Company leadership.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: We have developed and maintain a Material Cyber Incident Disclosure Program. The program includes processes for the identification, review and assessment of materiality of cyber events, notification of our senior leadership and Board of Directors of such events, and financial reporting disclosure where applicable. As part of the program, we also engage in due diligence regarding the cybersecurity capabilities of our current and potential third-party vendors in accordance with industry best practices. Under the program, all material cyber incidents will be reported to our Board of Directors. The program is led by our Cyber Event Disclosure Committee, which includes members of our Information Security, Corporate Legal, External Reporting and Enterprise Risk Management teams. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. For all critical third party service provides, we perform a review of the vendor's System and Organization Controls (SOC), which is referred to as a SOC 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to understand and mitigate any additional risks. Our assessment of risks associated with use of third-party providers is part of our overall risk management framework. We have implemented comprehensive cybersecurity initiatives for our employees, including education, training, and testing. These measures are conducted annually to ensure our employees remain up-to-date with the latest security practices, complementing our continuously improving processes and systems.


text: Our Chief Information Officer is responsible for developing and implementing our information security program. Our Information Security team monitors our exposure to external cybersecurity threats, leveraging automated tools and manual processes to ensure cybersecurity risk is effectively mitigated on a continuous basis. This team leverages internal IT resources, a managed security service provider, and additional third-party security software and technology services. When a specific incident has been identified, the Information Security team leverages our Cyber Incident Response Plan in conjunction with established Information Security policies to begin assessment of the incident. Depending on the type and/or severity of the incident, our Information Security team will determine (in compliance with our Cyber Incident Response Plan) whether third party expertise or consultation is necessary. If such expertise or consultation is determined to be necessary, our Information Security and Corporate Legal teams will engage with third-party experts. As part of its review of incidents, our Information Security team considers the risk exposure, potential impact, severity and implications with respect to our information technology systems. Our Information Security team is responsible for escalating incidents which are determined to be higher risk to our Cyber Event Disclosure Committee. The Cyber Event Disclosure Committee will work with our General Counsel to determine the materiality of the incident and any required disclosure. When an incident is determined to be material and is required to be disclosed, the Cyber Event Disclosure Committee will notify our senior leadership and our Board of Directors through the Audit Committee of our Board of Directors. The Cyber Event Disclosure Committee will collaborate with our Corporate Legal and Financial Reporting teams to develop any required Form 8-K Item 1.05 disclosure.


text: Emerson has a cybersecurity risk management program that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. Emerson maintains oversight of its cybersecurity risk management program through a governance structure that includes senior management, the Audit Committee and the Board of Directors (the "Board"). Emerson's cybersecurity risk management program leverages multiple layers of security controls across the Company's systems designed to establish risk treatment plans and regularly monitor risks. Emerson maintains cybersecurity policies and standards aligned with industry standard control frameworks and applicable regulations, laws and standards, and a global incident response plan.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Emerson's Board directly, or through its appropriate committees, provides oversight of management's efforts to mitigate cybersecurity risk and response to cyber incidents. The Board and/or its appropriate committees receive regular updates on cybersecurity from management and engage in discussions throughout the year, including with subject-matter experts as appropriate, on the function of the Company's overall cybersecurity program, cybersecurity risks, strategies for addressing these risks and the implementation thereof. The Audit Committee has oversight responsibility for the Company's enterprise cybersecurity risks. The Board also receives reports on cyber events, as appropriate, including response efforts, legal obligations and outreach and notification to regulators and/or customers when needed, as well as provide guidance to management as appropriate.


text: Emerson's Chief Information Security Officer, who has over twenty-five years' experience in information technology within the engineering and technology industries, with the last fourteen years dedicated to cybersecurity, oversees the Company's enterprise cybersecurity risk management program. The Chief Information Security Officer leads the global enterprise security team responsible for leading enterprise-wide information security strategy, architecture, processes, as well as assessing, identifying, and managing cybersecurity risks, which is an integrated aspect of our overall enterprise risk management program. The Chief Information Security Officer provides regular updates to senior management on key security performance indicators of our enterprise cybersecurity program. The Chief Information Security Officer also provides quarterly briefings on cybersecurity to the Audit Committee.


text: Emerson maintains a centralized 24x7x365 global incident response operation, managed by the global enterprise security team, supported by leading cybersecurity tools that detect and respond to threats as they occur. Every detected cyber incident is reviewed and assessed by Emerson's Computer Incident Response Team in accordance with our incident response plan, which contains documented escalation paths and is regularly tested.


text: Emerson engages independent third-party cybersecurity experts to evaluate our cybersecurity maturity and test effectiveness of overall cybersecurity controls. To test and reinforce Emerson's internal cybersecurity processes, the Company utilizes an accredited and independent third party to audit and certify key elements of our primary data centers, cloud environments and our enterprise IT organization. The audits are conducted according to International Organization for Standardization (ISO) 27001 Framework, although this is not meant to imply that we meet all technical standards, specifications or requirements under ISO 27001. In addition to performing periodic, internal security reviews, the Company also conducts cybersecurity tabletop exercises led by third party cybersecurity consulting firms from time to time, with the last such engagement occurring in 2023.


text: Emerson relies on third-party service providers for certain critical or key infrastructure, solutions, and services across our operations. Emerson has an internal vendor management team that assesses risks from vendors and suppliers that provide, amongst other things, key information and supply chain services to Emerson.


text: Emerson maintains a Cybersecurity Awareness Team, within the global enterprise security team, responsible for driving a global information security culture through awareness and education programs. It has created company-wide information security policies and procedures, reviews these regularly and makes them electronically available to our employees. The team works closely with subject matter experts to create educational material and communicate best practices to the company through online training, custom video content, simulated phishing attacks and a variety of other targeted touchpoints.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. See Item 1A - "Risk Factors" for additional information.


text: Risk Management and Strategy We are a global data, analytics and technology company. In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personal information of consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy.

companyName: EQUIFAX INC

ticker: EFX


text: Equifax has invested significantly to develop and maintain an information security program with processes, technology and controls to protect the information, systems and resources of the Company. We have a Security team operating under the leadership of our Chief Information Security Officer ("CISO"), including approximately 400 cybersecurity professionals. The key elements of our information security program, including our cybersecurity risk management strategy, are described below.


text: Security Controls Framework Equifax has implemented a unified security and privacy controls framework as our primary mechanism to establish strategic priorities related to cybersecurity, assess cybersecurity risk across the enterprise, comply with regulatory requirements and enhance security program maturity. Our unified security and privacy controls framework is based upon the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) and Privacy Framework (NIST PF).


text: Cybersecurity Incident Detection and Response Process Our information security program is based on five key functions as set forth in the NIST CSF: (i) identify; (ii) protect; (iii) detect; (iv) respond; and (v) recover. As part of that program, we maintain an incident detection and response process that is designed to ensure we appropriately identify, investigate, respond to, and recover from, cybersecurity incidents in order to protect our information, systems and resources. As part of our process, we maintain operational plans for incident response and recovery activities. We regularly review our incident response process and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident.


text: As part of our incident detection and response process, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within Equifax (including the CISO and the CEO) and to the Board of Directors based on incident severity. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our CISO, our Chief Financial Officer and our Chief Legal Officer.


text: To inform our incident detection and response process, our cyber intelligence operations team regularly performs exercises to simulate real threat scenarios that would be carried out by a perpetrator by utilizing the actual tools and methodologies that would be deployed in such an attack (so called "red team" activities).


text: • Cybersecurity Incorporated into Enterprise Risk Management Program. We have implemented an enterprise risk management ("ERM") program that operates under the leadership of our Chief Privacy and Compliance Officer. Each business unit and corporate support unit has primary responsibility for assessing and mitigating risks within its respective areas of responsibility, and the ERM team is responsible for oversight and reporting to management and the Board.


text: Under our ERM program, we conduct an annual enterprise risk assessment, which produces an enterprise risk scorecard. Cybersecurity is one of nine primary risk categories identified within the scorecard. The cybersecurity risk rating is based on a detailed enterprise security risk assessment performed by the Security team. The enterprise risk scorecard is reviewed with management and the Board of Directors on an annual basis.


text: • Security Risk Assessment. The Security team performs an annual enterprise security risk assessment of the information security program that is provided to management, the Board of Directors and other relevant parties. The security risk assessment provides a detailed understanding of the information security program in order to inform decisions and support risk response. The security risk assessment process evaluates the program's control domains through various analyses and testing methods to determine the overall level of risk present within the environment over the period evaluated. The risk assessment identifies risks and considers observations from multiple business process- and system-level assessments.


text: We leverage NIST guidance to inform our process for conducting the security risk assessment. The risk management program and processes can be described in four steps: (i) frame risk; (ii) assess risk; (iii) respond to risk; and (iv) monitor risk.


text: • Third Party Risk Management. We have a governance process in place to oversee our third-party vendors who have access to our network or who hold or store personal information on our behalf ("risk vendors"). Our risk vendor contracts contain provisions requiring our suppliers to maintain a program that meets our information security standards. We periodically assess risk vendor compliance with our information security program requirements. One such requirement is the obligation that our risk vendors must notify Equifax within a designated time period upon identifying certain cybersecurity events. • M&A Due Diligence and Integration Process. Our Security team has implemented a due diligence and integration process for entities we acquire through mergers and acquisitions ("M&A"). This process is designed to protect our information systems, align acquired entities with our security controls, and comply with applicable legal and regulatory requirements, without interrupting critical business processes. Our M&A security integration status is reported regularly to management and the Technology Committee and annually to the Board of Directors. • Employee Training and Awareness. In order to help bolster our cybersecurity defenses and mitigate the risk presented by insider or employee cyber and security threats, Equifax has incorporated employee training into our security program. On an annual basis, all employees are required to complete mandatory security training. In addition, each Equifax employee receives training customized to his or her role or function, and has visibility into his or her individual security performance. We continually measure and assess key employee behaviors, including secure browsing and sensitive data handling. In order to promote a Company-wide focus on data security and reinforce overall security program goals, Equifax includes an individual security performance measure as one of the metrics used to evaluate the performance of all bonus-eligible employees under our annual incentive compensation program. • Cybersecurity Insurance. We maintain cybersecurity insurance under our errors and omissions/professional liability policy, which provides coverage for certain costs related to cybersecurity incidents.


text: Review and Assessment of Information Security Program We conduct regular audits of our information security program, including third party assessments and review by our internal audit department.


text: • Third Party Assessments of Security Program Maturity. Equifax has a formal process in place to annually assess our security program maturity, which is a measure of our ability to adapt to cyber threats and manage risk over time. Under the oversight of the Technology Committee of the Board of Directors, Equifax engages a third party research and advisory firm to conduct an annual analysis of the maturity of our security program and identify potential initiatives to enhance maturity. On an annual basis, the Technology Committee reviews the results of this analysis with management, including a review of Company performance against relevant benchmarks. • Controls Testing. Equifax has a formal process in place to periodically assess the effectiveness of controls in our security controls framework. These controls assessments are performed by the Security team. Results are regularly reported to management and the Technology Committee and annually to the Board of Directors. • Internal Audit Review. Our internal audit department is responsible for providing the Audit and Technology Committees and management with an independent assessment and assurance regarding the design and effectiveness of the risk management framework related to cybersecurity. As part of the assessment of our cybersecurity program, the internal audit department has a "red team" that regularly performs testing to simulate real threat scenarios that would be carried out by a perpetrator. On a quarterly basis, our head of Internal Audit provides an update to management and the Audit and Technology Committees of the Board on audit activities pursuant to the IT and security portions of the internal audit plan. Our head of Internal Audit reviews the IT and security audit reports issued, including a summary of IT and security audit findings by inherent risk and residual risk rating.


text: Cybersecurity Risks to our Business As a global data, analytics and technology company, our products and services involve the storage and transmission of personal information of consumers. As a result, we are routinely the target of attempted cyber and other security threats presented by outside third parties, as well as security threats presented by employees and other insiders.


text: In 2017, we experienced a material cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K. consumers. If we experience additional significant compromises of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed, altered or lost. Any such access, disclosure, alteration or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.


text: Cybersecurity incidents, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.


text: For additional information related to the cybersecurity-related risks relevant to our business, see "Risk Factors—Technology and Data Security Risks—Security breaches and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and reputation" in Part I, Item 1A. of this annual report on Form 10-K.


text: Board Oversight of Cybersecurity The Equifax Board of Directors monitors our "tone at the top" and risk culture and oversees principal risks facing the Company. On an annual basis, the Board reviews an enterprise risk assessment prepared by management that describes the principal risks and monitors the steps management is taking to map and mitigate these risks. The Board then sets the general level of risk appropriate for the Company through business strategy reviews. Risks are assessed throughout the business, focusing on nine primary risk categories, including cybersecurity.


text: In addition, the Audit and Technology Committees of the Board coordinate on risk management oversight with respect to cybersecurity, including through quarterly joint meetings that cover the following topics: • Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan • Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items • Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity The Technology Committee of the Board oversees our information security program, including: • Reviewing with management our technology investments and infrastructure associated with risk management, including policies relating to information security, disaster recovery and business continuity • Receiving quarterly reports directly from our CISO, including updates on our enterprise cybersecurity threat level • Overseeing the engagement of outside advisors to review our cybersecurity program • Reviewing the results of our annual information security program maturity assessment performed by a third party • Reviewing the results of our annual security program risk assessment prepared by management Management Oversight of Cybersecurity Risk Our information security program is managed through implementation, monitoring and continuous improvement of the security program with active participation of management as described below. • Senior Leadership Team. The Equifax senior leadership team, consisting of our CEO and his direct reports ("SLT"), sets the tone for strategic growth, effective operations and risk mitigation at the management level. The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues. The SLT has overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax. • Chief Information Security Officer. Equifax has a CISO who is a member of the SLT and reports directly to our CEO. Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies. Our CISO is responsible for oversight of the global Security team and the implementation and execution of the information security program. Our CISO helps ensure that the program is strategically aligned to Equifax's business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors. • Global Security Team. The Equifax global Security team is responsible for supporting the CISO in the execution of the information security program to meet the program's objectives. The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.