text: The practice of our CISO and CIO is to communicate significant cybersecurity matters directly to senior management, including our Chief Executive Officer, Chief Financial Officer and General Counsel, which ensures that our executive management team remains continually informed of critical events impacting our business.


text: For cybersecurity matters deemed material to the Company, senior management will communicate such matters directly to the Audit Committee to enable members of the Audit Committee to offer comprehensive oversight and guidance on crucial cybersecurity matters.

companyName: Enpro Inc.

ticker: NPO

secItem: Item 1C


text: Due to the increasing risk of third and fourth-party business relationships, we implemented a Third-Party Risk Management ("TPRM") Program to evaluate and monitor our network of external partners, vendors, suppliers, and service providers. Capabilities of our TPRM program include continuous monitoring of third parties, secure vendor remote access, and security architecture to protect against cyber threats introduced through other business-to-business ("B2B") system integrations. In addition to above, we have implemented and maintained the following cybersecurity measures as part of our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K): • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity Incident Response Plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Tabletop Exercises - periodic internal and vendor-led tabletop exercises to assess the effectiveness, relevance, and completeness of the Incident Response Plan and Business Resilience Plans; • Assessments - annual cybersecurity assessments, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel during onboarding and periodically throughout the year that highlights critical organizational risks through quarterly phishing simulation campaigns, "lunch and learns", monthly communication updates, and relevant cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments – review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.


text: Please see 1A. Risk Factors in this Form 10-K for more information regarding cybersecurity-related risks that could materially affect our business strategy, results of operations, or financial condition, including under the heading "Our business may be adversely affected by information technology disruptions".


text: From a management perspective, our Chief Information Security Officer ("CISO") and Senior Vice President and Chief Information Officer ("CIO") lead our cybersecurity efforts. Our CISO has extensive experience in cybersecurity, including creating and supporting cybersecurity programs for larger publicly-traded companies, obtaining cybersecurity certifications, participating in relevant cybersecurity leadership communities, and public speaking engagements on cybersecurity topics. He leads a cross functional cybersecurity team, which includes members of our legal department and internal audit function. As part of his job function, our CISO is charged to remain informed of the latest developments in cybersecurity, including the evolving threat landscape, as well as risk management improvement methods. This continual focus and understanding of the threat landscape, as well as risk treatment practices, is required to ensure that the CISO can effectively manage the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: Our CISO implements a program and supporting processes to proactively assess systems for vulnerabilities, while taking a risk-based approach to prioritize remediation steps. Should a cybersecurity incident occur, the CISO would reference an incident response plan and supporting playbooks to support the incident response process. We regularly test our incident response process by leveraging a combination of internal resources and trusted third-party consultants to test our response readiness and the completeness of our incident response plan through the use of tabletop exercises.


text: Our CISO and CIO regularly advise the Audit Committee on cybersecurity risks and the company's cybersecurity program, including quarterly updates and comprehensive briefings to the Audit Committee annually. During these briefings, our cybersecurity leaders advise the Audit Committee regarding (i) the current threat landscape and related risks; (ii) the Company's security posture and compliance efforts; and (iii) current cybersecurity strategy and recommended next steps to address cybersecurity threats on a risk-adjusted basis.


text: Over the past several years we have invested significantly to enhance our cybersecurity governance. We have expanded our control access to data and systems, invested in firewalls and security systems, elevated internal awareness through trainings and exercises, and upgraded our systems, programs and intrusion monitoring.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: We conduct periodic vulnerability assessments based on our use of technology, third party vendor relationships and reported changes in cybercrime methodologies, and in response to any attempted cyber incident, among other circumstances.


text: We protect all the assets of our clients and safeguard the proprietary and confidential information of Westwood and its employees, which is a fundamental responsibility of every Westwood employee. Westwood is responsible for distributing our policies and procedures to employees and conducting appropriate employee training to ensure employees' adherence to our policies and procedures. Repeated or serious violations of our policies by employees or independent contractors may result in disciplinary action against such persons, which may include restricted permissions or prohibitions and/or termination.


text: Our President and Chief Operating Officer is responsible for reviewing, maintaining and enforcing our policies and procedures to ensure we meet our overall cybersecurity goals and objectives, while at a minimum, ensuring compliance with applicable federal and state laws and regulations.


text: We have also designed procedures to implement our cybersecurity policy, minimize cybersecurity threats to our clients and conduct reviews to monitor and ensure our policy is observed, properly implemented and amended or updated as necessary, including cybersecurity oversight, periodic risk assessments and external consultant reviews, access restrictions, ongoing training, governance policies and procedures, authentication protocols, secure access measures, and policies for elevating suspicious activities.


text: Westwood has an established vendor management policy, which considers risks related to new or existing vendors, defines new vendor selection, vendor renewal, vendor monitoring and vendor risk assessment. The review of vendors is led by our Chief Compliance Officer and each vendor relationship owner, and involves reviewing System and Organization Controls reports, Statement on Standards for Attestation Engagements number 18 reports, and other reviews of internal controls.


text: Westwood's Board is responsible for overseeing the effective execution of our overall cybersecurity programs. Along with management, our Board reviews our cybersecurity efforts and programs and is informed of cybersecurity risks primarily through discussions with management, trainings and exercises.


text: Westwood relies on its Board, in conjunction with senior management members, to ensure ongoing success of its cybersecurity environment. Our Board's responsibilities include, but are not limited to: a. Overseeing effective implementation of our cybersecurity initiatives and alignment with agreed policies and strategies;


text: b. Oversight of the continued and consistent implementation of our cybersecurity policies and procedures; and c. Promoting overall corporate commitment to cybersecurity.


text: Westwood management is responsible for the execution of the framework for the management of our information security. These responsibilities include, but are not limited to: a. Designing, implementing and executing our framework over information security management; b. Reviewing and updating our policies and procedures annually;


text: c. Assigning all data within Westwood to an appropriate owner, and ensuring data owners have knowledge of such data and have an information classification selected for that data; d. Ensuring annual compliance with our information security management policies and procedures;


text: e. Application and execution of our risk management framework in the event of a potential issue; and f. Development and execution of an action plan for each potential issue to address risks via remediating, mitigating, accepting or closing the issue.


text: Our management members, specifically our Chief Executive Officer, Chief Financial Officer, President and Chief Operating Officer, Information Security Officer and Chief Compliance Officer, have cybersecurity expertise gained through years of training, internal and external discussions, numerous learning exercises, and development, execution and evaluation of our cybersecurity policies.


text: If a potential cybersecurity breach were to be identified, management would implement its incident response plan. This plan, which provides for a quick, effective and orderly response to information security incidents relies on our Incident Response Team ("IRT") to report findings to management and the appropriate authorities as necessary. The IRT, comprised of various cross-functional subject matter experts, is also responsible for: a. Detecting and analyzing suspicious events that might indicate an event has occurred;


text: b. Containing, eradicating and restoring normal operations if an event has occurred through quick responses, isolating and preserving evidence to aid in remediation and assisting investigators, isolating additional systems from being impacted by the situation being remediated, tracking issues, communicating a strategy and protocol to follow to maintain control of information and confidentiality and to ensure members of the IRT and Westwood management are kept informed of issues as the incident develops and is resolved, and developing and implementing strategies for ensuring the integrity of impacted information systems and critical information hosted on those systems.


text: In the event of a cybersecurity breach Westwood management notifies our Board as soon as practicable, along with affected parties including clients, regulatory bodies, third parties and employees, as necessary and required by applicable laws and regulations.


text: We have invested significantly over the past several years to enhance our cybersecurity governance. We have expanded our control access to data and systems, invested in firewalls and security systems, elevated internal awareness through trainings and exercises, and upgraded our systems, programs and intrusion monitoring.


text: Our goal is to protect all the assets of our clients and safeguard the proprietary and confidential information of Westwood and its employees, which is a fundamental responsibility of every Westwood employee. Westwood is responsible for distributing our policies and procedures to employees and conducting appropriate employee training to ensure employees' adherence to our policies and procedures. Repeated or serious violations of our policies by employees or independent contractors may result in disciplinary action against such persons, which may include restricted permissions or prohibitions and/or termination.


text: We have designed procedures to implement our cybersecurity policy, minimize cybersecurity threats to our clients and conduct reviews to monitor and ensure our policy is observed, properly implemented and amended or updated as necessary, including cybersecurity oversight, periodic risk assessments and external consultant reviews, access restrictions, ongoing training, governance policies and procedures, authentication protocols, secure access measures, and policies for elevating suspicious activities.


text: Westwood's Board is responsible for overseeing the effective execution of our overall cybersecurity programs. Along with management, our Board reviews our cybersecurity efforts and programs and is informed of cybersecurity risks primarily through discussions with management, educational sessions and exercises.


text: Our Board's responsibilities include, but are not limited to: a. Overseeing effective implementation of cybersecurity initiatives and alignment with our policies and strategies;


text: Westwood management is responsible for the execution of the framework for the management of our information security. These responsibilities include, but are not limited to: a. Designing, implementing and executing our framework for information security management; b. Reviewing and updating our policies and procedures annually;


text: If a potential cybersecurity breach were to be identified, management would implement its incident response plan. This plan, which provides for a quick, effective and orderly response to information security incidents relies on our Incident Response Team ("IRT") to report findings to management and the appropriate authorities as necessary. The IRT, comprised of various cross-functional subject matter experts, is also responsible for: a.detecting and analyzing suspicious events that might indicate a breach has occurred; and b.containing, eradicating and restoring normal operations through quick responses, isolating and preserving evidence to aid in remediation and assisting investigators, isolating additional systems from being impacted by the situation being remediated, tracking issues, communicating a strategy and protocol to follow to maintain control of information and confidentiality and to ensure members of the IRT and Westwood management are kept informed of issues as the incident develops and is resolved, and developing and implementing strategies for ensuring the integrity of impacted information systems and critical information hosted on those systems.


text: In the event of a cybersecurity breach Westwood management notifies our Board as soon as practicable, along with other affected parties including clients, regulatory bodies, third parties and employees, as necessary and required by applicable laws and regulations.


text: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and mange risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity. Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat detection, and incident response processes. Our CISO has a background in cybersecurity and risk management, including assessing, designing, building and operating security platforms. He has over 10 years of information technology and information security experience having successfully built and led security programs on areas relating to cybersecurity, risk management, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation, and compliance initiatives. The CISO, who reports directly to our Chief Information Officer, provides periodic reports to our Board of Directors, as well as our Chief Executive Officer, Chief Information Officer, and other members of our senior management as appropriate. Our CISO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, including the results of security breach simulations, and the emerging threat landscape. Our Board of Directors will be informed of all material cybersecurity incidents and our information security program includes procedures for calling a special session of the Board of Directors in the event of a high or critical-risk cybersecurity incident. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.

companyName: XPO, Inc.

ticker: XPO


text: As part of our information security program, our CISO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on available information and classify the severity of potential cybersecurity incidents. XPO employs technical measures to protect against cybersecurity attacks that align with functions identified in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, and unusual traffic on our systems and meets regularly to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business. Our information security team also reviews relevant legislative and regulatory developments and conducts regular and tailored information security training for our global workforce, in various formats.


text: In the event of a cybersecurity incident, our incident response team, composed of members of our information security team as well as other key personnel, identifies, evaluates, and quantifies the relevant risks based on the available information and classifies the severity of the cybersecurity incident based on the level of risk to the Company. Our incident response measures include procedures to provide incident updates and developments to our senior management and the Board of Directors in the event of an ongoing cybersecurity incident. We also maintain an information security risk insurance policy. We conduct internal exercises to prepare our leadership and cross-functional teams to respond in the event of a cybersecurity incident and to help us test and consider revisions to our incident response procedures. We also actively engage with key consultants, auditors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board of Directors. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect the Company.


text: While we have dedicated significant resources to identifying, assessing, and managing material risks from cybersecurity threats, our efforts may not be adequate, may fail to accurately assess the severity of an incident, may not be sufficient to prevent or limit harm, or may fail to sufficiently remediate an incident in a timely fashion, any of which could harm our business, reputation, results of operations and financial condition. For an additional discussion of certain risks associated with cybersecurity see Item 1A, "Risk Factors" above.


text: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and manage risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity. Our information security program is overseen by our Chief Information Officer ("CIO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat prevention, threat detection, and incident response processes. Our CIO has over 15 years of information technology and information security experience and he and his team have experience in cybersecurity and risk management, including assessing, designing, building and operating security platforms, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation and compliance initiatives. The information security team provides periodic reports to our CIO, Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. Our CIO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, including the results of security breach simulations, and the emerging threat landscape. Our Board of Directors will be informed of all material cybersecurity incidents and our information security program includes procedures for calling a special session of the Board of Directors in the event of a high or critical-risk cybersecurity incident. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.


text: As part of our information security program, our CIO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on internal and external available information and classify the severity of potential cybersecurity incidents. XPO employs technical measures to protect against cybersecurity attacks that align with functions identified in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, indicators of compromise, and unusual traffic on our systems. The information security leadership team meets regularly to ensure our processes to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business, are effective and current. Our information security team also reviews relevant legislative and regulatory developments and conducts regular and tailored information security training for our global workforce, in various formats.


text: In the event of a cybersecurity incident, our incident response team, composed of members of our information security team as well as other key personnel, identifies, evaluates, and quantifies the relevant risks based on the available information and classifies the severity of the cybersecurity incident based on the level of risk to the Company. Our incident response measures include procedures to provide incident updates and developments to our senior management and the Board of Directors in the event of an ongoing cybersecurity incident. We also maintain an information security risk insurance policy. We conduct internal exercises to prepare our leadership and cross-functional teams to respond in the event of a cybersecurity incident and to help us test and consider revisions to our incident response procedures. We also actively engage with key consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board of Directors. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect the Company.


text: Risk Management and Strategy Verint takes steps to protect our data and third-party data we receive from our customers through the implementation of technological and organizational measures designed to reduce the risk from cybersecurity threats, including data theft or destruction.

companyName: VERINT SYSTEMS INC


text: Under the oversight of the Board of Directors, we regularly undertake enterprise risk assessments and have implemented policies, procedures, and programs designed to help manage the risks to which we are exposed in our business, including cybersecurity risks. As part of our enterprise risk management process, we have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, as well as the systems of third parties on whom we rely, such as our cloud hosting partners. Our cybersecurity program is designed to assess, identify, and manage material risks and vulnerabilities to our security posture, including prioritizing and remediating cybersecurity risks. Our program calls for, among other things: • incorporation of cybersecurity in our overall enterprise risk management processes, including periodic enterprise risk assessments and tools used to track and monitor risks; • regular reviews of cybersecurity risks and mitigation efforts specifically; • use of software and hardware tools and services to help safeguard our systems and product offerings; • certifications or conformance for certain products and services; and • assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.


text: Core security operational and engineering functions, along with third-party supplier security assessments, are managed by our internal security employees. Third-party consultants are engaged to perform assessments of our cybersecurity program, and for security incident response where impact and materiality reach a critical threshold.


text: In addition, we provide an employee information security training program to educate employees on various cybersecurity risks and mitigation strategies. We also maintain policies and processes governing our third-party security risks. As part of these processes, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require certain third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of certain data breaches that may impact our data.


text: We have experienced cybersecurity incidents in the past and expect to continue to experience them in the future. We do not believe that any past cybersecurity incidents have had a material adverse effect on our business, operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program will prevent or mitigate a cybersecurity threat or incident, and it is possible that such events could occur, and could have a material adverse effect on our business, operations, or financial condition in the future. See the "Risk Factors" in Part I, Item 1A of this report for further discussion of the cybersecurity and related risks we face.


text: Verint's cybersecurity program is overseen by our Chief Information Security Officer ("CISO"), whose team is responsible for managing and executing on our cybersecurity strategy, policy, standards, architecture, and processes, including as described above. Our CISO has over 25 years of leadership experience in IT and cybersecurity and maintains an industry leading cybersecurity certification. Verint's overall cybersecurity team holds relevant skills training and certifications based on their specific focus areas, such as security operations, cyber risk management, and data security. Our cybersecurity team is regularly trained to combat current and emerging threats. Verint maintains and operates a 24x7 security operations center "SOC" that monitors all aspects of our security infrastructure. Verint's SOC executes our security incident response plan inclusive of identification, mitigation, remediation, and recovery processes. These processes govern assessment of materiality and impact, along with management of communications, response, and recovery plans. Our CISO reports to our Chief Administrative Officer ("CAO") and provides regular reports on our cybersecurity program to the CAO and other members of our senior management team.


text: The Board of Directors oversees risk management and compliance generally, including information security and cybersecurity. The Audit Committee of our Board of Directors has primary responsibility for supervising our cybersecurity program on behalf of the Board consistent with the requirements of its charter, including with respect to risk management, risk assessment, oversight of management's activities and expertise, and disclosure controls and procedures; however, the full Board is briefed regularly throughout the year. As part of the cybersecurity oversight by the Audit Committee and our Board of Directors, our CAO provides formal reports to the Board (including to all members of the Audit Committee) at least quarterly. These reports include updates on our cyber risks and threats, information security systems, and information security program. In addition, our CAO and CISO also meet directly with members of the Audit Committee on an ad hoc basis to discuss and seek guidance on our cybersecurity program.


text: The board of directors oversees risk management and compliance generally, including information security and cybersecurity. The Audit Committee of our board of directors has primary responsibility for supervising our cybersecurity program on behalf of the board consistent with the requirements of its charter, including with respect to risk management, risk assessment, oversight of management's activities and expertise, and disclosure controls and procedures; however, the full board is briefed regularly throughout the year. As part of the cybersecurity oversight by the Audit Committee and our board of directors, our CAO and CISO provide formal reports to the board (including to all members of the Audit Committee) at least quarterly. These reports include updates on our cyber risks and threats, information security systems, and information security program. In addition, our CAO and CISO also meet directly with members of the Audit Committee and other directors on an ad hoc basis to discuss and seek guidance on our cybersecurity program.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this Form 10-K for additional information.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • Implementing an Information Security Program that establishes policies and procedures for security operations and governance; • Establishing an Information Security Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • Implementing layers of controls and not allowing excessive reliance on any single control; • Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; • Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; • Leveraging people, processes and technology to manage and maintain cybersecurity controls; • Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; • Performing due diligence with respect to our third-party service providers, including their cybersecurity practices; • Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • Conducting periodic cybersecurity training for our employees and the Company's Board.


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Security Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Security Committee. The Information Security Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for West Bank. The Information Security Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.


text: In addition, the Company's Board, both as a whole and through its Risk and Information Technology Committee (Risk Committee) is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board and the Risk Committee, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Risk Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents on at least a quarterly basis.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving sets of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this Form 10-K for additional information.


text: Our business operations, including the provision of the products and services described above, involve the compilation and transmission of confidential information, including patient health information. We also collect and store other sensitive data such as credit card, insurance, and other information. We have included security features in our systems that are intended to protect the privacy and integrity of this information, but our systems may be vulnerable to security breaches, viruses, programming errors and other similar disruptive problems.

companyName: TruBridge, Inc.

ticker: TBRG


text: The Board of Directors is responsible for exercising oversight of management's identification of, and planning for, the material risks facing the Company, and we believe our risk management policies and procedures are adequate to ensure that relevant information about cybersecurity risks and incidents is appropriately reported and disclosed. In October 2017, the Board authorized the formation of a Cybersecurity Committee, which is now known as the Governance, Risk & Compliance ("GRC") Committee. Our cybersecurity risk management process, which are discussed in greater detail below, are led by the GRC Committee. The GRC Committee is currently comprised of the Chief Technology and Innovation Officer, Chief Financial Officer, General Manager of TruBridge, General Manager of EHR, General Manager of Patient Engagement, Corporate Security Officer, and General Counsel and Corporate Compliance Officer. The GRC Committee generally meets weekly, and has a formal meeting quarterly, to discuss the primary security and compliance-related risks currently facing the Company, including cybersecurity risks. The General Counsel and Corporate Compliance Officer then provides updates to the Board at each regular quarterly meeting. Annually, the full Board participates in cybersecurity training and discusses the internal incident management process with the GRC Committee.


text: In October 2020, the Board created the Innovation and Technology Committee to aid the Board in its duties to assess and oversee the management of risks in the areas of information technology, information and data security, cybersecurity, disaster recovery, data privacy and business continuity. This committee oversees the GRC Committee's activities relating to information technology and cybersecurity matters, and seeks to enhance communication and coordination of efforts between the Board and management in these areas. The members of the Innovation and Technology Committee monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management process described below, including the operation of our incident response plan.


text: Additionally, we have a Security Operations Center ("SOC") to oversee several initiatives designed to improve our cybersecurity protection, readiness and response. The Company partnered with a third party to provide Security as a Service ("SECaaS") to assist our internal SOC in reducing the likelihood and impact of a cybersecurity attack. The SOC oversees penetration testing, vulnerability scanning, intrusion prevention, endpoint and insider threat detection, log management and other cybersecurity-related projects. The Company also consulted with third parties to achieve ISO 27001 certification related to information security management, which was achieved starting in 2020 and maintained every year since.


text: Our SOC team members have over 35 years of combined work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and developing and overseeing programs and policies related to various areas, including incident response, eDiscovery, forensic investigations, log analysis, malware analysis, risk management, physical security, and enterprise security operations, as well as several relevant degrees and certifications, including Masters degrees in Cybersecurity and Information Assurance, Bachelors degrees in Information Technology, BS Information Systems and Cybersecurity, Certified Information Systems Security Professional, Certified Ethical Hacker, Computer Hacking Forensic Investigator, A+, Network+, Security+, MS Sentinel, a Degree in forensic science and others being worked on. Prior work experience, knowledge, skills, or background for the SOC team include: law enforcement, DoD contractor work in cybersecurity, heavy involvement in numerous large scale intrusion investigations, published author of an Intrusion Analysis book, presentations at numerous conferences focused on cybersecurity, hundreds of forensic analysis cases, prior employment by other companies as cybersecurity/SOC analysts, and continuous on the job training We have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our process to industry standards and best practices standards set by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO"), as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from information and cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: a.closely monitor emerging data protection laws and implement changes to our processes designed to comply; b.conduct annual customer data handling and use requirements training for all our employees; c.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: d.conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: e.through policy, practice and contract (as applicable), require employees, as well as third-parties who provide services on our behalf, to protect customer information and data;


text: f.run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;


text: g.leverage the NIST and ISO incident handling frameworks to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and h.maintain multiple layers of controls, including embedding security into our technology investments.


text: We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance. An example of the assessment we use is the ISO 27001 assessment that was implemented started in 2020. Our team is continually evaluating our technology vendors and tools to ensure that we are managing evolving threats to the best of our ability.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Finally, all users employed by or contracted to the Company are required to complete annual cybersecurity education and training, which includes identifying suspicious emails, internet threats, telecommunication threats and ransomware.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Breaches of security and viruses in our systems could result in client claims against us and harm to our reputation causing us to incur expenses and/or lose clients" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K,which disclosure is incorporated by reference herein. Although we maintain cybersecurity insurance to reduce potential financial losses that may stem from cybersecurity incidents, the costs related to cybersecurity threats or disruptions may not be full insured.


text: The Board of Directors is responsible for exercising oversight of management's identification of, and planning for, the material risks facing the Company, and we believe our risk management policies and procedures are adequate to ensure that relevant information about cybersecurity risks and incidents is appropriately reported and disclosed. In October 2017, the Board authorized the formation of a Cybersecurity Committee, which is now known as the Governance, Risk & Compliance ("GRC") Committee. Our cybersecurity risk management process, which are discussed in greater detail below, are led by the GRC Committee. The GRC Committee is currently comprised of the Chief Technology and Innovation Officer, Chief Financial Officer, General Managers of the business units, Corporate Security Officer, Corporate Privacy Officer, and General Counsel and Corporate Compliance Officer. The GRC Committee generally meets weekly, and has a formal meeting quarterly, to discuss the primary security and compliance-related risks currently facing the Company, including cybersecurity risks. The General Counsel and Corporate Compliance Officer then provides updates to the Board at each regular quarterly meeting. Annually, the full Board participates in cybersecurity training and discusses the internal incident management process with the GRC Committee.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Breaches of security and viruses in our systems could result in client claims against us and harm to our reputation causing us to incur expenses and/or lose clients" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K,which disclosure is incorporated by reference herein. Although we maintain cybersecurity insurance to reduce potential financial losses that may stem from cybersecurity incidents, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Risk Management and Strategy Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stockholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Information Security Officer ("CISO"), Commvault's cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We procure security technologies, consistently work to mature our cybersecurity program, and partner with security service providers. We have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third parties to enhance monitoring and response capabilities and facilitate readiness activities including tabletop exercises and penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls through a risk assessment questionnaire and include security and privacy terms in contracts as appropriate.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations like privacy and sanctions compliance or travel & expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements at the direction of Management. The findings, observations, and recommendations from these engagements are shared with Management and the Audit Committee, as appropriate.


text: To date, Commvault is not aware of any cybersecurity incidents that have materially affected Commvault's financial condition or business operations. Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition.


text: For additional description of cybersecurity risks and potential related impacts on Commvault, refer to the risk factor captioned "Risks Related to Technology and Security – We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security" in Part 1, Item 1A. "Risk Factors."


text: Commvault's Board of Directors (the "Board") provides oversight of Commvault's enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board of Directors receives quarterly briefings on the cybersecurity program from the CISO and briefings on the Enterprise Risk Management Committee ("ERMC") and Cybersecurity Oversight Team ("CSOT") from the Chief Legal and Compliance Officer ("CLCO"). The Board is kept apprised of cybersecurity updates through quarterly, or as needed, reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CISO.


text: Commvault's Management, including the CEO, CFO, CLCO, CISO, Chief Information Officer ("CIO"), and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision-making, and incident preparedness and response. The current CISO holds a Bachelor of Science in Information Technology, industry certifications such as CISSP, CISA, CISM, is affiliated with various CISO professional working groups, and has over twenty-five years of experience in information security, compliance, technology, and program management across financial, telecommunications, audit, healthcare, retail, and professional services organizations. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and the CSOT and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks including cybersecurity threats across the business. The CSOT is responsible for the significant operational decisions in the event of an active cybersecurity incident. The CSOT meets as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.


text: Risk Management and Strategy Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stakeholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Security Officer ("CSO"), Commvault's cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We partner with industry-leading cybersecurity experts for continuous monitoring, alerting, mitigation and responsiveness related to our cybersecurity program. We adopt industry best practices and security technologies and have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third party service providers to enhance our monitoring and response capabilities, facilitate readiness activities including tabletop exercises, and perform various methods of cybersecurity penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls and include security and privacy terms in contracts as appropriate.


text: Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations, such as privacy and sanctions compliance and travel and expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements. The findings, observations, and recommendations from these engagements are shared with Management, including the CEO, CFO, Chief Trust Officer, CSO, Chief Information Officer ("CIO"), and Senior Vice President of Engineering and the Audit Committee, as appropriate.


text: Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. To date, Commvault is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Commvault, including its business strategy, results of operations or financial condition. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition. For example, in February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor. As part of the ongoing investigation regarding this activity, the Company immediately activated its incident response plan, issued security advisories, and implemented several advanced security measures, including enhanced rotation of credentials and strengthened security monitoring, among other proactive measures.


text: Commvault's Board of Directors (the "Board") provides oversight of Commvault's enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board receives quarterly briefings on the cybersecurity program from the CSO and briefings on the Enterprise Risk Management Committee ("ERMC") from the Chief Trust Officer. The Board is kept apprised of cybersecurity updates through quarterly reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CSO.


text: Commvault's Management, including the CEO, CFO, Chief Trust Officer, CSO, CIO, and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision- making, and incident preparedness and response. The current CSO holds a Bachelor of Science and Master of Business Administration from the University of Maryland, industry certifications such as CISSP, PMP, CIPP/E, CIPP/US and CISA, is affiliated with various industry working groups focused on threat intelligence and privacy, and has over twenty years of experience in cybersecurity leading technical, operational, and strategic programs to protect critical data and infrastructure. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks, including cybersecurity threats across the business. An Executive Security Council is responsible for the significant operational decisions in the event of an active cybersecurity incident. The Executive Security Council meets monthly, or as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.


text: CarMax's cybersecurity program is designed to help ensure the proper assessment, identification, and management of the company's risks from cybersecurity threats and is integrated into our overall risk management system. The company's cybersecurity program is staffed by well-trained and experienced cybersecurity professionals and includes technology controls, proactive identification of data security vulnerabilities, and quarterly, or as needed, reporting by management to the Technology and Innovation Committee of the Board of Directors (the "Board").

companyName: CARMAX INC

ticker: KMX


text: CarMax's cybersecurity team manages the company's Incident Response Plan, which establishes a comprehensive system and process for tracking and logging cybersecurity occurrences, reviewing the occurrences to determine whether remediation or escalation is appropriate and escalating certain occurrences to the company's Chief Information Security Officer (the "CISO") for further review and assessment. CarMax has an established review and escalation process for assessing cybersecurity occurrences and, if necessary, escalating cybersecurity incidents to members of our senior management team.


text: We monitor industry trends to prioritize and mitigate cybersecurity risk for our customers, associates and business, and to remain apprised of industry developments and emerging threats. CarMax engages in testing to improve our cybersecurity approach internally and with third-party vendors and conducts exercises based on current threat intelligence. Additionally, all CarMax associates are required to complete the company's cybersecurity training program on an annual basis.


text: The company engages a third-party with extensive experience in cybersecurity to periodically perform a maturity analysis of CarMax's cybersecurity program as compared to peer companies. We conduct annual tabletop exercises, guided by a third-party cybersecurity firm, with key members of our cybersecurity and legal teams to assess the company's readiness and capabilities to respond to a cyber-attack. At least annually, we also conduct third-party penetration tests to enhance the security of our digital systems, and we employ network scanning to help us identify any newly developed vulnerabilities or threats. Our third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, CarMax's cybersecurity team conducts reviews of the company's third-party vendors depending on the vendor's risk profile as determined by the company's cybersecurity team.


text: The company's cybersecurity program is led and overseen by our Chief Information and Technology Officer (the "CITO") and our CISO. The CITO joined CarMax in 2012, reports to our Chief Executive Officer and has served in various technology leadership roles in startup organizations and Fortune 500 companies across the retail, travel, hospitality, finance, and technology industries for over 20 years. The company's CISO reports to the CITO, joined CarMax in 2015 and has served in various roles in information technology for over 20 years, including prior service as the vice president of information security, risk and compliance for a Fortune 500 company.


text: The Board's Technology and Innovation Committee assists in the Board's oversight of the company's cybersecurity risk. The Committee monitors and oversees the company's exposure to cybersecurity occurrences as well as the company's approach to managing cybersecurity risk, including how to reasonably control and monitor cybersecurity risks and effectively assign management oversight and responsibility. CarMax's management team, including the CITO and the CISO, provide quarterly updates to the Committee regarding the cybersecurity landscape and the company's security posture in the context of external cybersecurity occurrences as well as updates on the latest issues related to cybersecurity risk as needed.


text: The company has not experienced any material cybersecurity incidents or incurred any material expenses resulting from a cybersecurity breach; however, we cannot provide assurance that our business strategy, results of operations and financial condition will not be materially affected in the future by such risks or any future material incidents. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to the risk factors captioned "We rely on third-party vendors for key components of our business" and "We collect sensitive confidential information from our customers. A breach of this confidentiality, whether due to a cybersecurity or other incident, could result in harm to our customers and damage to our brand" set forth under the heading "Risk Factors" included in Part I, Item 1A of this Form 10-K.


text: The company engages a third-party with extensive experience in cybersecurity to periodically perform a maturity analysis of CarMax's cybersecurity program as compared to peer companies. We conduct annual tabletop exercises, guided by a third-party cybersecurity firm, with key members of our cybersecurity and legal teams to assess the company's readiness and capabilities to respond to a cyber-attack. At least annually, we also conduct third-party penetration tests to enhance the security of our digital systems, and we employ network scanning to help us identify any newly developed vulnerabilities or threats. Our third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, CarMax's cybersecurity team conducts periodic reviews of the company's third-party vendors depending on the vendor's risk profile as determined by the company's cybersecurity team.


text: The company's cybersecurity program is led and overseen by our Chief Information and Technology Officer (the "CITO") and our CISO. The CITO joined CarMax in 2012, reports to our Chief Executive Officer and has served in various technology leadership roles in startup organizations and Fortune 500 companies across the retail, travel, hospitality, finance, and technology industries for over 20 years. The company's CISO reports to the CITO, joined CarMax in 2015 and has served in various roles in information technology and cybersecurity for over 30 years, including prior service as the vice president of information security, risk and compliance for a Fortune 500 company. Our CISO has various industry certifications, including the Certified in Risk and Information Systems Control (CRISC), the Certified in the Governance of Enterprise IT (CGEIT) and the Certified Information Systems Auditor (CISA) certifications.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework).

companyName: Plymouth Industrial REIT, Inc.


text: This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management ("ERM").


text: Key components of our cybersecurity risk management program include: assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; awareness training of our employees, incident response personnel and senior management;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.


text: this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We face risks associated with security breaches through cyber-attacks, cyber intrusions, as well as other significant disruptions of our information systems."


text: Board of Directors recognizes the critical importance of maintaining the trust and confidence of our tenants, business partners, investors, and employees. Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations. The Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Committee provides regular reports to our Board of Directors and provides our Board of Directors with timely updates regarding any ongoing cybersecurity incident. On an annual basis, our Board of Directors and the Committee discuss our approach to cybersecurity risk management with members of our management's cybersecurity committee.


text: management cybersecurity committee, led by our CFO and Director of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of Information Security has served in various roles in information technology and information security for over 20 years. Our managed service provider has over 20 years of experience managing multi-national IT operations, including strategy, applications, infrastructure, information security, support, and execution.


text: management cybersecurity committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and protect the confidentiality, integrity, and availability of our data. Presently our information systems are limited to databases maintained by third parties. As a result, we have limited policies and procedures to assess, identify, and manage material risk from cybersecurity threats. We assess risks from cybersecurity threats against our third-party information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats. Presently we do not believe there are any material threats to our systems.

companyName: GROOVE BOTANICALS INC.

ticker: GRVE


text: Following these risk assessments, if needed, we evaluate whether and/or how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We do not yet have an IT manager given our limited exposure to risks, and therefore the review of our limited systems is undertaken by our President to manage the risk assessment and mitigation process. When applicable to our corporate structure and when we believe exposure to risks within our systems exceeds the current limited levels of exposure, we will monitor and test our safeguards and train our employees on the implementation of such safeguards, in collaboration with human resources, IT, and management, as available. We aim to promote a company-wide culture of cybersecurity risk management as we grow in size.


text: As of the date of this report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our President is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and AI Risk Management Framework. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key components of our cybersecurity risk management program include: risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training of our employees, incident response personnel and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item IA. Risk Factors— Risks Related to Our Business and Operations—We face risks associated with security breaches through cyber-attacks, cyber intrusions, as well as other significant disruptions of our information systems."


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our tenants, business partners, investors, and employees. Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our management cybersecurity committee, led by our CFO and Director of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of Information Security has served in various roles in information technology and information security for over 20 years. Our managed service provider has over 20 years of experience managing multi-national IT operations, including strategy, applications, infrastructure, information security, support, and execution.


text: Our management cybersecurity committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our assets and our people and have put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Universal Token

ticker: UTKN


text: Our operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors.


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.


text: Additionally, insider threats also remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time employees. As referenced above, our third-party vendors and service providers and their supply chain connections remain a potential source of risk.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is built upon industry standards and we have deployed sophisticated software both from internal and external sources to mitigate cybersecurity threats. We identify security threats through internal audits of our systems. We also require any service providers to provide System and Organizational Control ("SOC") type reports to ensure that data is secure and our duty to protect information is fulfilled.


text: Cybersecurity Governance We believe that all employees of the company have a duty to manage cybersecurity. We have implemented industry standard guidelines that help ensure that cybersecurity governance is a priority. Our BOD is also very involved in the cybersecurity governance. We conduct regular searches for threats and suspicious activities, and we monitor passwords and change passwords within industry expectations. Due to the technical aspects, we have a lot of individuals that are very capable and are able to quickly act if we are to find any issues with our cybersecurity.


text: Risk Management and Strategy The Company has an enterprise risk management program to identify, assess, monitor, and manage significant risks of the Company. The Company evaluates cybersecurity risks alongside other critical business risks under this program, and the Company also has a standalone cybersecurity program. The Company's approach to assessing, identifying, and managing material risks from cybersecurity threats is grounded in established frameworks, including those set forth by the National Institute of Standards and Technology (NIST) and other industry standards and requirements as defined by various compliance frameworks. Our cybersecurity program prioritizes key areas such as: • Policies, Standards, and Practices: We maintain comprehensive policies, standards, and practices aligned with industry practices and regulatory requirements. These documents serve as the foundation for our cybersecurity program, providing clear guidelines for safeguarding our information systems and data assets. • Threat Monitoring and Assessment: Continuous monitoring and assessment of cyber threats and vulnerabilities are integral to our risk management strategy. We utilize advanced monitoring tools and threat intelligence sources to proactively identify and address potential security risks. The Company uses third-party service providers to support its operations. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. • Audits and Assessments: Regular audits and assessments are conducted by both internal and external experts (consultants, auditors, and other third parties) to evaluate the effectiveness of our cybersecurity controls and processes and recommend improvements. These assessments help us achieve compliance with internal policies as well as external regulations and standards. • Incident Response Planning: We have developed comprehensive incident response plans to mitigate cybersecurity incidents. These plans outline clear procedures for detecting, responding to, and recovering from security breaches, minimizing the impact on our operations and stakeholders. External technical, legal, and law enforcement support is engaged as needed to support response efforts.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: The Company employs a multifaceted approach through in house capabilities and in partnership with external cybersecurity experts to safeguard its assets, including technical and organizational measures. These include the deployment of technology focused on identifying and remediating threats, ongoing employee training exercises, regular incident response capability reviews and exercises, cybersecurity insurance coverage, and business continuity mechanisms.


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from our Chief Technology Officer (CTO) on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from the CTO. Further, the Board oversees cybersecurity as part of our enterprise risk management program.


text: To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. For instance, in December 2023, the Board engaged in a discussion with cybersecurity experts on building resilience to cyber risk. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.


text: Our CTO, supported by our Vice President of Infrastructure and Security, assumes primary responsibility for assessing and managing material cybersecurity risks. With over 25 years of experience spanning restaurant, retail, and technology brands, our CTO brings a wealth of expertise to the role. Having previously held similar positions leading and overseeing cybersecurity programs at both private and public companies, our CTO is well-equipped to navigate the complex landscape of cybersecurity threats and challenges.


text: Our Company has established robust policies and processes governing the assessment, response, and notifications associated with cybersecurity incidents. These protocols ensure a systematic and coordinated approach to incident management, with collaboration among engineering, legal, and senior leadership to oversee compliance with legal and regulatory requirements and have clear mechanisms in place for escalating notifications to our CEO and the Board based on the nature and severity of each incident.


text: While we have experienced cybersecurity incidents in the past, in the last fiscal year we have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from senior management on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from senior management. Further, the Board oversees cybersecurity as part of our enterprise risk management program.


text: To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. The Board routinely engages in discussions with cybersecurity experts on building resilience to cyber risk and receives updates regarding management tabletop exercises. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.


text: Currently, our Vice President of Infrastructure and Security assumes primary responsibility for assessing and managing material cybersecurity risks. With experience spanning restaurant, retail, financial, and technology brands, including serving in similar roles overseeing information security programs at other companies, and a degree in Computer Science, our Vice President of Infrastructure and Security brings experience and expertise to the role. Our Vice President of Infrastructure and Security leads a team of professionals who oversee the prevention, detection, and remediation activities within our cybersecurity environment.


text: The Company has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; and an incident response program documenting cybersecurity incident response and notification procedures. The Company's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Information Security Review Committee (ISRC) and the Information Systems Steering Committee (ISSC). The ISO has several years of professional experience in cybersecurity and vendor management, and holds multiple relevant professional certifications. The ISO provides an update to the Board of Directors on a quarterly basis. The Information Security Program is approved by the Board annually.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: The ISO maintains risk assessments for key IT systems. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are also used annually to assess cybersecurity risk.


text: Third parties are assessed and categorized according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on inherent risk as well as specifics such as if the vendor hosts data in the cloud or has access to consumer information.


text: The Company uses a training system to educate new and existing employees on cybersecurity risks. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks.


text: The Company uses data loss prevention and web filtering software to ensure malicious data does not enter the Company's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. All Company networks are secured behind firewalls. Additionally, Security Information and Event Management (SIEM) technology, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS) are used.


text: Access to data on the Company's networks is granted only if needed for job functions. Data Security Analysts review changes to access to ensure they are authorized and appropriate.


text: An Incident Response Committee that includes representatives from key areas of the Company meets in the event of cybersecurity incidents. The Committee ensures the proper notifications are made in order to comply with all relevant laws, rules and regulations.


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company. For discussion of the risks from cybersecurity threats, including potential impact to the Company's business strategy, results of operations, and financial condition, refer to "Item 1A – Risk Factors – The Company's information systems may experience an interruption or breach in security" in this Report, which is incorporated by reference in this paragraph.


text: Risk management and strategy The Company employs a multi-faceted approach to assess, identify, and manage material risks from cybersecurity threats. Components of our approach include the following:

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: The use of a cyber risk matrix that assesses the likelihood and impact of threats and risks identified in the Company's hardware, software, and data systems. Threats are ranked by potential severity and mitigation / remediation efforts are tracked. Matrix is updated on a semi-annual basis and as new risks are identified. System penetration testing is performed by rotating third-party service providers at least every 18 months. System vulnerability testing is performed by the Company monthly. Network assessments are performed at least annually by qualified third-party service providers.


text: Monitoring of Federal government alerts (CISA, FBI) and industry threat information is performed to stay current on the newest cybersecurity threats bad actor tactics.


text: Multifactor authentication is required for all authorized users to access network resources which adds a second layer of protection from unauthorized entry to our systems.


text: The cybersecurity practices and controls are derived from multiple recognized cybersecurity frameworks to meet the evolving needs of our organizations.


text: The cybersecurity risk assessment process is part of the Company's overall risk management process. As noted above, the Company utilizes third-party consultants and services in our process of assessing and managing cybersecurity risk. To mitigate the risk of cybersecurity threats related to the use of third-party service providers, the Company obtains and reviews System of Organization Controls (SOC) reports from third parties when available, to provide assurance that the third-party has appropriate controls in place and has not identified any significant cyber issues. The Company does not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. See Item 1A "Risk Factors" for a summary of certain cybersecurity risks.


text: While general risk assessment and management oversight resides with the Company's Audit Committee, oversight of risks from cybersecurity threats resides with our Board of Directors. The Company's Audit Committee is in charge of reviewing the Company's information security disclosures and incident reporting related to cybersecurity. The Company's Board of Directors is in charge of reviewing the Company's information security procedures and evaluating management's assessment of materiality for cyber incidents. The Board of Directors is formally updated on cybersecurity risks by the VP of Information Technology no less than annually. Management is responsible for assessing and managing material risks from cybersecurity threats. This responsibility primarily resides with the VP of Information Technology and his qualified team, including dedicated cyber security personnel. The qualifications of the Information Technology team include a combination of formal education (e.g. degrees in Information Assurance, Computer Information Systems, Computer Networking, and current enrollment in a Cyber Security degree program); current trainings and certifications in systems, network and cybersecurity; and, over 100 years of combined Information Technology experience. Management's process for monitoring prevention, detection, mitigation, and remediation of cybersecurity incidents is summarized above in the Risk management and strategy section.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Information Technology Steering Committee and our board of directors.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of internal and external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institution Examination Council Cybersecurity Assessment Tool, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Information and Operations Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions and maturing our Information Security Program.