text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit, and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Our Corporate Compliance Officer is Lynn A. Feldman, the Company's Executive Vice President, Chief Legal Officer and Corporate Secretary. Ms. Feldman has over 20 years of experience leading the legal and risk management departments of public companies. Her areas of responsibility cover privacy, cybersecurity risk and data protection; governance, including with respect to cybersecurity; and global legal compliance and reporting. For additional information about Ms. Feldman's experience, please refer to the " Information About Our Executive Officers " section in this Annual Report on Form 10-K.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO

secItem: Item 1C


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading technology solutions in startups to executing strategic initiatives in large enterprises.


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has almost 20 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions, and operational evaluation of cyber products.


text: Our European and Latin American businesses also maintain cybersecurity programs, which are led by experienced officers as outlined in the Company's 2023 Annual Report on Form 10-K.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. The Information Security and Privacy team leads cybersecurity risk management for our business. Effective Cyber Risk Management is foundational to our Information Security and Privacy program and is based on recognized frameworks established by the National Institute of Standards and Technology (NIST). Our Information Security and Privacy Risk Management program includes processes and controls for the business to ensure that cybersecurity risks are identified and responded to promptly. These range from formal processes that are triggered in certain circumstances, to detective controls and technology that we use to identify and manage risks. Information Security and Privacy's Risk Management process is consistent with our Enterprise Risk Management Policy, which describes how we manage risks generally. The Information Security and Privacy team also engages with external consultants to ensure best practices in our Cyber Risk Management.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management and strategy focus on several areas: • Risk Identification and Reporting: We have implemented a comprehensive, cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. The program includes controls and procedures to properly identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain an assessment from management as to the public disclosure and reporting of material incidents in a timely manner. The Information Security and Privacy team's responsibilities include: Conducting privacy impact assessments; Rating cyber risk severity, coordinating remediation, and monitoring cyber risks within our enterprise risk register; Cyber threat intelligence functions, including monitoring cybercrime and geopolitical developments; Supporting mergers and acquisitions activities, including integration of newly acquired businesses; Performing security architecture reviews, both of existing enterprise systems and those of newly acquired organizations;


text: Monitoring and ensuring Payment Card Industry Data Security Standard (PCI-DSS) compliance where required across the enterprise; and Conduct and supervision of penetration testing.


text: • Technical Safeguards: We have implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. The Information Security and Privacy team also manages and carries out logging, and vulnerability and application scanning, to support the identification of cyber risks. • Incident Response and Recovery Planning: We maintain comprehensive incident response, business continuity, and disaster recovery plans designed to guide our response to cybersecurity incidents. We also conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management (TPRM): We maintain a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all levels of employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: The Board, in coordination with our Global Data Governance Board (GDGB) and the Audit Committee, oversees our risk management program, including the management of cybersecurity threats. The GDGB receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security.


text: The Chief Information Security and Privacy Officer (CISPO) is the risk manager overseeing the organization's information security risk management function. As the Risk Manager, the CISPO is responsible for the administration of the information security risk management program, policy, and procedures. This includes ensuring that risks are properly identified, assessed, managed, and reported as prescribed by the organization. The Risk Manager also has the responsibility of promoting an effective risk management culture through regular training across the organization. The CISPO has direct communication with senior executives regarding cybersecurity risks and works collaboratively with our leadership to respond to and manage the response to cybersecurity incidents. The CISPO has nearly 20 years of legal and data protection experience with a focus on Information Security, Privacy, and Abuse Prevention.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including its business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors - Risks Relating to Information Technology, Cybersecurity and Intellectual Property.


text: Risk Management and Strategy We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray any financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.

companyName: Under Armour, Inc.

ticker: UAA


text: We have adopted, and periodically review and update, information security and privacy notices, policies and procedures. We maintain annual cybersecurity and data privacy training for all employees with access to our corporate systems. In addition, as part of our Payment Card Industry Data Security Standard compliance, we maintain annual role-based training on protecting payment card information for all relevant employees. We conduct proactive incident preparedness activities focused on cybersecurity risks and business continuity, such as annual table-top exercises with our senior management, as well as periodic phishing simulations to test our employees' responses to suspicious emails.


text: We utilize third-party service providers as a part of our day-to-day business operations. Certain of the networks and systems used to conduct our operations are managed by such third-party service providers and are not under our direct control. To address cybersecurity risk to our operations arising from our relationships with third-party service providers, we maintain a third-party risk management program, which includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. In addition, members of our management team conduct an enterprise-wide internal risk assessment through our ERM program that is updated annually and reviewed and discussed by the Audit Committee. This risk assessment is designed to identify our most material risks, including cybersecurity risks, for evaluation and monitoring. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.


text: Our CISO leads our global cybersecurity team and is responsible for our cybersecurity program. Our current CISO has served in various roles in information technology and information security for over twenty years, including at our Company since 2013. He holds an MBA and a Certified Information Systems Security Professional certification. Our CISO reports to our Chief Technology Officer, who reports to our Chief Executive Officer.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats. including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our digital posture and enterprise risk management strategy. Cybersecurity is critical to maintaining the trust of our customers and business partners, and we are committed to protecting our and their confidential and sensitive information, including personal information, and mitigating cybersecurity risks that impact our systems and networks. We maintain technologies, programs and processes designed to assess, identify, manage and mitigate cybersecurity risks. Our efforts include regular monitoring of Leidos-managed programs for internal and external cybersecurity threats, providing cybersecurity training to our employees during the onboarding process and annually, and continually reviewing and refining formal policies and procedures designed to deter, identify and remediate cybersecurity incidents. We regularly perform evaluations of our cybersecurity program and continue to invest in our capabilities to keep our customers, partners, suppliers and information assets in our possession safe. Although we employ service provider due diligence and onboarding procedures to identify potential cybersecurity risk, our ability to monitor the cybersecurity practices of our service providers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: Our Chief Information Security Officer leads our Cybersecurity Intelligence and Response Team ("CSIRT") whose function is to stay apprised of existing and emerging cyber threats and monitor our global enterprise and proactively identify and protect against cybersecurity risk. The CSIRT uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for, and address adversary activity against the Leidos network. The CSIRT possesses in-depth knowledge of network, endpoint, perimeter security systems, identity, data protection, threat intelligence, forensics, penetration testing and malware reverse engineering, as well as the functioning of specific applications or underlying information technology infrastructure.


text: Leidos CSIRT owns the incident response process and provides direction and guidance to users of Leidos computing resources when responding to cybersecurity incidents. Leidos CSIRT also provides intrusion monitoring of networks and information systems and continuously monitors the Leidos computing environments and performs triage and analysis of events to identify potential incidents.


text: We employ multiple security and monitoring devices and applications throughout the Company to identify, alert, report and log all authorized and unauthorized access to the Leidos enterprise networks. We use an application that collects, correlates, and notifies CSIRT analysts regarding any item meeting an electronic intrusion event. We categorize anomalous cyber events into discrete levels in which cybersecurity matters are escalated to certain levels of management, as well as our Board, based on the severity of the incident, as appropriate. Sharing cyber threat information at these levels supports the Company's ability to integrate cybersecurity considerations into its overarching risk management system and processes.


text: We also conduct periodic internal and third-party assessments to test our cybersecurity controls, perform cyber simulations and exercises, and continually evaluate our internal governing policies and procedures to help detect and respond to cybersecurity events in order to reduce harms or impacts from breaches and other information security incidents.


text: Management's Responsibilities Our global information security program is led by our corporate Chief Information Security Officer, who works closely with key corporate functional and line of business stakeholders. The Chief Information Security Officer partners with these functions for the purpose of identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures, reporting cybersecurity breaches and other information security incidents, and maintaining our cybersecurity program. The team of senior management officers, who support our information security program, have expertise with cybersecurity, as demonstrated qualifications such as by prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. Our management team receives regular updates on our cybersecurity posture and reviews detailed information about our cybersecurity preparedness. Additionally, we have a Leidos Security Council that is co-chaired by the Chief Information Security Officer and the Chief Security Officer to address "all security hazards" across our global enterprise to ensure cohesion and effectiveness of our combined security governance and risk mitigations.


text: Board's Roles and Responsibilities We have a Technology and Innovation Security Committee, comprised of six board members, with relevant backgrounds and experience, that oversees and advises the Board and management on matters involving the Company's overall strategic direction and significant business risks and opportunities in the areas of technology and information security.


text: At least quarterly, management provides our Board and the Technology and Information Security Committee with updates about our cybersecurity and related risk exposures, our policies and procedures to mitigate such exposures and the status of projects to strengthen our information security infrastructure and program maturity and defend against and respond to cybersecurity threats. In addition, we use a risk-based escalation process to notify the Board and the Technology and Information Security Committee outside of the regular reporting cycle should we identify a significant emerging risk or potentially material issue that should be brought to their attention.


text: Cybersecurity Threats To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or our financial condition. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Cybersecurity breaches and other information security incidents could negatively impact our business and financial results, impair our ability to effectively provide our services to our customers and cause harm to our reputation or competitive position" in this Annual Report on Form 10-K.


text: Risk Management and Strategy Envestnet's Information Security Program uses a risk-based approach to assess, identify and manage material risks from cybersecurity threats and is an integral part of our enterprise risk management program and processes. The Information Security Program is complemented by our business continuity and disaster recovery planning controls. Envestnet's Group Head, Cybersecurity/Information Security Officer is a member of the firm's Risk Management Committee.

companyName: ENVESTNET, INC.


text: We regularly update our enterprise-wide Information Security Program to align with industry best practices and applicable regulations. Envestnet's Information Security Program includes a policy framework that leverages elements from National Institute of Standards and Technology Cybersecurity Frameworks, NIST 800-53 Standards, ISO 27001, Cloud Security Alliance, and other relevant industry best practices to protect the confidentiality, availability, and integrity of our data and systems.


text: Directed by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security team defines, implements and monitors our Information Security Program. We review and approve our security policies, procedures, and standards annually or whenever material updates are made during the year. Moreover, we undergo SOC 1 Type 2, SOC 2 Type 2, and PCI-DSS (where applicable) audits on multiple technology platforms. In addition to our Information Security team, we use third-party vendors to help address material risks from cybersecurity threats. Among other things, third parties conduct security assessments, monitor endpoint security, probe our defenses, and conduct cybersecurity exercises. We also leverage third-party providers to aid management to detect, respond and recover in the event of a cyber incident.


text: To keep information security risks related to suppliers and other third parties within an acceptable range, Envestnet has a third-party oversight program. This program categorizes our third parties, assesses the potential impact of a compromise of Envestnet data and other resources in relation to the third-party's engagement and manages the risk associated with third parties. This risk management includes understanding whether the third-party has required controls in place, whether it has vulnerabilities that need to be managed before beginning work with us and what residual risks will remain and require acceptance or further decision making.


text: Risks from Cybersecurity Threats No risks from cybersecurity threats materially affected Envestnet's business strategy, results of operations or financial condition during the year that ended December 31, 2023. Moreover, such risks do not appear to be reasonably likely to affect our business strategy, results of operations or financial condition.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats Envestnet's Board of Directors maintains regular oversight of risks from cybersecurity threats. In particular, its Compliance and Information Security Committee reviews, assesses, and makes recommendations to our Board about our regulatory compliance programs and information technology security framework, including cybersecurity threats. This includes receiving regular reports from the Information Security team on audits, security issues, changes in risk postures and regulatory matters. The Compliance and Information Security Committee also oversees selection of Envestnet's independent security assessors and reviews their reports. The Committee is authorized to request that any Envestnet director, officer, employee, outside counsel or independent auditor attend a meeting of the committee or meet with any of its members or advisors.


text: The majority of the directors who serve on the Compliance and Information Security Committee must be independent. The Committee meets quarterly and on an ad hoc basis.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Envestnet's senior management assesses and manages material risks from cybersecurity threats through its Information Security Management Committee. The Information Security Management Committee provides direction, management, support and sponsorship associated with information security. Chaired by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security Management Committee consists of Envestnet's Executive and Senior management from Operations, Legal, Compliance, Systems, Business, Human Resources and Finance.


text: Our Group Head, Cybersecurity/Information Security Officer has a total of more than 28 years of experience in cybersecurity, technology and information technology roles with financial services, technology and consulting companies. She joined Envestnet in 2020.


text: The Information Security Management Committee's responsibilities include, but are not limited to: • Setting, reviewing and supporting the components of the Information Security Program; • Monitoring significant risk trends and proposing changes to controls and policies, as appropriate; • Ensuring that information security is resourced and prioritized; • Ensuring the proper execution of risk management activities; • Establishing and maintaining a culture that promotes information security; • Reviewing and evaluating the implementation and effectiveness of the Information Security Program through regular external and internal assessments; • Maintaining cybersecurity incident response preparedness; • Providing support for and visibility to information security initiatives; and • Coordinating with the Information Security team to provide regular reports to the Compliance and Information Security Committee of the Board of Directors about audits, security issues, changes in risk postures and regulatory matters, among other cybersecurity topics.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet Specialty Products Partners, L.P.


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which material cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.


text: Our Director of Information Technology, who has extensive cybersecurity knowledge and skills gained from over twenty years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President — Chief Financial Officer. The Director of Information Technology receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implements by the Company to identify and mitigate data protection and cybersecurity risks. Our Director of Information Technology works with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of material incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. As part of our overall risk mitigation strategy, the Company maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity incidents or other related breaches. Please refer to Part I, Item 1A "Risk Factors — Risks Related to Our Business" for additional information about our cybersecurity risks.


text: Cybersecurity Risk Management and Strategy The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Our Vice President of IT is tasked with continuous monitoring of our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee and other stakeholders, and ongoing training and awareness of employees. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of an incident having occurred at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the event. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee which will convene to review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.


text: Cybersecurity Governance and Oversight The governance of our cybersecurity risks involves active and informed participation from our management team, our Audit Committee, and our Board. The Audit Committee, which receives regular updates from the Cybersecurity Committee, maintains oversight of our cybersecurity strategies and risks and will consider such updates as part of the Company's overall risk management program. This oversight includes briefings on the nature of the risks we face, the steps we are taking to mitigate these risks, and any significant cybersecurity incidents that have occurred. In addition, our Vice President of IT will provide reports and updates to the Audit Committee and to the full Board as the need arises. All Board members may attend the meetings of the Audit Committee during which cybersecurity is discussed and will be included in any tabletop exercises as they are planned.


text: Cybersecurity Risk Management and Strategy The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Cybersecurity Committee members rely on the cybersecurity experience of the Company's head of IT, which includes more than twenty years of experience in cybersecurity and information technology, with focused expertise on cybersecurity strategy, architecture, policy, and processes. Remaining team members have a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").


text: Our Vice President of IT is tasked with continuously monitoring our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of a cybersecurity incident at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the incident. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee, which will appropriately review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.


text: Risk Management and Strategy Computer viruses, malware, phishing attacks, denial-of-service attacks and similar cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.

companyName: YELP INC

ticker: YELP


text: We have implemented and maintain various information security measures, processes, standards and policies, as applicable, designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, as well as the data of our users, customers, partners and employees ("Information Systems and Data"): • Risk Identification and Assessment. The Engineering Security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various internal resources as well as third-party products and services. For example, depending on the environment, system and data, we use manual and automated tools, including third-party cybersecurity software; subscription reports and services from threat intelligence service providers; scans of the threat environment; audits; and threat assessments. • Risk Management. Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, as applicable to specific environments, systems and data, our Security Incident Response Plan, our Vulnerability Management Policy, data encryption, network security controls and data segregation. • Vendor Management. We also have a vendor management program to manage cybersecurity risks associated with our use of third-party service providers, such as AWS, Oracle and Workday, to perform various functions throughout our business. The program includes risk assessments, security questionnaires and security assessment calls with vendors' security personnel as appropriate. Depending on the nature of the services provided, the characteristics of the affected Information Systems and Data, and the identity of the provider, our process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider and imposing contractual obligations related to cybersecurity on the provider. • Employee Engagement and Education. In addition to the processes and practices described above, we work to empower employees to recognize and respond to cybersecurity risks. For example, we regularly host hackathons, which encourage our Product and Engineering teams to collaborate to test creative ideas, including for security solutions. In addition to keeping employees informed about cybersecurity best practices throughout the year, our IT and Engineering Security teams host "Hacktober" each October to promote security awareness in honor of National Cyber Security Awareness Month. Hacktober consists of activities such as weekly trivia challenges to help educate employees about how they can securely access corporate systems, recognize and report phishing email attempts, and take other actions to protect Yelp. To test employee readiness, these teams also send simulated phishing emails that direct employees to additional training if they engage with the email contents.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section titled " Risk Factors—If our security measures are compromised, or if our platform is subject to attacks that degrade or deny the ability of users to access our content, users may curtail or stop use of our platform. "


text: Our Board oversees the Company's aggregate risk profile and risk management process. The Board administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer, our Vice President of Engineering Security and our Director of Engineering Security. Each of these individuals has extensive industry experience developed through a significant career in engineering, IT and systems management, and security, respectively. Our Chief Technology Officer received a B.A. in Computing and Artificial Intelligence, and his experience includes the development of intrusion detection and firewall functionality for products at a global technology company. Our Vice President of Engineering Security received an M.S. in Business Analytics, with a focus on Computer and Information Systems, and her experience includes more than 15 years in systems management and administration at a major U.S. financial institution. Our Director of Engineering Security received an M.S. in Telecommunications Networks with a specialization in Security, is a Certified Information Systems Security Professional, and has more than 15 years of experience building security programs, including building and leading the incident response team at a global software company.


text: Our Chief Technology Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Technology Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Director of Engineering Security works with our Chief Technology Officer and Vice President of Engineering Security to develop a cybersecurity strategy that aligns with our business strategy and is responsible for implementing that strategy through his leadership of the day-to-day operations of our Engineering Security team.


text: Our Vulnerability Management Policy and Security Incident Response Plan are designed to escalate certain cybersecurity vulnerabilities and incidents, respectively, to members of management depending on the circumstances, including the Vice President, Director and other members of the Engineering Security team. Our Security Incident Response Plan also provides for escalations to our General Counsel and other members of the Legal team, as well as for notification of our Chief Technology Officer. The Engineering Security team and other members of management work with the incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: Our Chief Technology Officer and members of the Engineering Security team typically meet twice annually with the Audit Committee to review the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them. The Chair of the Audit Committee, in turn, reports to the full Board.


text: Risk Management and Strategy Computer viruses, malware, phishing attacks, denial-of-service attacks and other cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.


text: Our Chief Technology Officer and members of the Engineering Security team typically meet bi-annually with the Audit Committee to review the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them. The Chair of the Audit Committee, in turn, reports to the full Board.


text: Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.

companyName: Compass Group Diversified Holdings LLC


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, and prevention and protection capabilities. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations.


text: We also apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers, including those in our supply chain that have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk process. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.


text: Both the board of directors and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our board of directors and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the board of directors in a timely manner.


text: Risk Management and Strategy Cybersecurity risk management and strategy is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.


text: Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: CorEnergy's information security program is managed by our President and Chief Financial Officer, whose information technology team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Financial Officer provides periodic reports to our Board, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.

companyName: CorEnergy Infrastructure Trust, Inc.


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats to us and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of


text: Index to Financial Statements Information Technology and our Senior Director of Information Security. The topics reported by the Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats to us, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology, information security and engineering for over 14 years and within Mueller for four years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information technology and information security within Mueller for over 20 years.


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are charged with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST"). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Independent Assessments We regularly engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including 24/7 detect and response services, network activity monitoring, phishing prevention, penetration testing and periodic IT security maturity assessments. As part of these efforts, we have engaged third-party cybersecurity providers to help deploy and monitor these safeguards and to assist in the event of a security incident or similar issue by conducting forensics reviews and assisting more broadly with the mitigation and remediation of any such event.


text: Third-Party Risks We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness All employees are required to complete information security awareness training upon joining the Company. Based on individual phishing test performance and job requirements, additional training may be offered or required on an as-needed basis.


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. For information regarding cybersecurity risks that may materially affect us, see the risk factors titled "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," and "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation" as well as "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation" under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes, including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats that we may face in our operations and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of Information Technology and our Senior Director of Information Security. The topics reported by the


text: Index to Financial Statements Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats we face, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology for over 20 years and within Mueller for over five years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information security and engineering within Mueller for over 21 years.


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are responsible for addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST") and combined with the Center of Internet Security ("CIS") controls framework are used to develop actionable steps for improving technical defenses and protecting against common threats. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Independent Assessments We engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. See "Item 1A. RISK FACTORS" - "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation," and "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation."


text: Our cybersecurity measure is primarily focused on ensuring the security and protection of computer systems and networks. We utilize a third-party service provider, as well as internal resources, to monitor and, as appropriate, respond to cybersecurity risks. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We also periodically scan our environment for any vulnerabilities and perform penetration testing. In addition, to promote security awareness, we provide cybersecurity risk training to all employees at least annually.

companyName: Kartoon Studios, Inc.

ticker: TOON


text: Oversight responsibility for information security matters is shared by the Board, Chief Financial Officer ("CFO"), VP of Internal Audit and our internal information technology ("IT") resources. Our CFO and VP of Internal Audit oversee our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives quarterly updates from IT and the third-party IT service provider on cybersecurity and information security matters. The CFO communicates with the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Board for timely and accurate reporting of any material cybersecurity incident.


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: PRECIGEN, INC.

ticker: PGEN


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program, and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors-If we experience a significant breach of data security or disruption in our information systems, our business could be adversely affected." in this annual report on Form 10-K.


text: Cybersecurity Governance Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Chief Operating Officer ("COO") who serves as the chairman of the security steering team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. The security steering team also includes the leadership of our Information Technology ("IT") team. The IT team consists of seasoned security professionals well-versed in emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents. Precigen also employs the use of cybersecurity vendors to actively monitor and remediate cybersecurity threats and incidents. Management, including the COO, regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity updates. Such updates cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.


text: Our board of directors has overall oversight responsibility for our risk management and is charged with oversight of our cybersecurity risk management program. The board is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry's best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NEXPOINT DIVERSIFIED REAL ESTATE TRUST

ticker: NXDT


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay distributions".


text: Our business depends on information technology systems and networks, which we protect from cyber threats that could harm our data, operations, and reputation. We have invested in security measures designed to safeguard the data of our customers and employees, prevent, detect, and respond to cyberattacks, and comply with data privacy requirements.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: Cybersecurity Governance Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. We use a risk-based and layered approach to prevent, detect, and respond to cyberattacks, and leverage external partnerships for threat intelligence.


text: Our management is responsible for risk identification, risk management and risk mitigation strategies associated to cybersecurity related information technology risks, including fully documenting our cybersecurity policies and procedures and cybersecurity risk management program as well as implementing a cybersecurity risk management program and ensuring compliance with our cybersecurity policies and procedures. Our Senior Vice President of Quality, GMP Operations, and Information Technology leads our Information Technology team, which includes experienced and information security professionals and has expertise in various aspects of cybersecurity, such as network security, data protection, incident response, threat intelligence, and security awareness. Our Information Technology Team's expertise is supplemented by external consultants who provide specialized services and independent assessments of our cybersecurity posture and capabilities.


text: Management has appointed a Cybersecurity Incident Response Team (the "CSIRT") which is operationally responsible for coordinating, executing, and managing cybersecurity incident response activities. The CSIRT is comprised of experienced information security personnel from our Information Technology team. The CSIRT's responsibilities include, among other things, incident identification and escalation to designated members of management. Among the designated members of management who are required to be notified are our Chief Executive Officer and our Chief Financial Officer.


text: Our Board of Directors has appointed its Audit Committee as its primary body to oversee management's risk identification, risk management and risk mitigation strategies related to cybersecurity related information technology risks.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: SOUTH 8 ENERGY, LLC


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A. Risk Factors."


text: Cybersecurity Governance Our cybersecurity program addresses potential risks, implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from a third-party that provides relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. The third-party provider provides regular data protection and cybersecurity reports to our senior management who then provides regular reports to the Audit Committee and the Board of Directors. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Risk Management and Strategy As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement when responding to such issues. Additionally, our cybersecurity program is regularly audited by independent third parties, and we incorporate regular information security training as part of our employee education and development program. We maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Hanesbrands Inc.


text: Because we are aware of the risks associated with third-party service providers, we also have implemented robust processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.


text: We also understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. Our policies provide explanations of the types of information we collect, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.


text: Some of the other steps we have taken to detect, identify, classify and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Conducting security maturity posture assessments, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a regular basis; • Utilizing industry-standard technologies, processes, and capabilities designed to protect our systems and data and detect potential suspicious activity; • Adopting a vendor risk management program, which includes cybersecurity and data privacy audits, classifying vendor, service provider or business partner risk based on several factors and evaluating and monitoring related risk mitigation efforts; • Providing security and privacy training and awareness to our employees; • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training; and • Maintaining cyber liability insurance.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For additional information regarding the ransomware attack we announced on May 31, 2022, see the section captioned "Overview - Ransomware Attack" under Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations" below. Other than this ransomware attack, as of the date of this report and for the years presented, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operational Risks - Any inadequacy, interruption, integration failure or security breach with respect to our information technology could harm our ability to effectively operate our business and have a material adverse effect on our business, results of operations, financial condition and cash flows" under Part I, Item 1A "Risk Factors" above.


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.


text: The Board regularly reviews our cybersecurity and other technology risks, controls and procedures. The Board receives reports from our Chief Executive Officer and Chief Information Officer at least twice annually regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. In addition, our cybersecurity infrastructure is overseen by our Chief Information Security Officer, who reports to our Chief Information Officer. Our Chief Information Security Officer has served in various roles in information technology and information security for over 20 years, including most recently leading the information security function of McCormick & Company. He holds a Ph. D. in information assurance & security, along with industry certifications that include ISACA Certified Data Privacy Solutions Engineer and Certified Information Security Manager and EC-Council's Certified Chief Information Security Officer certification. Our Chief Information Officer reports to our Chief Executive Officer and has served in various roles in information technology and information security for over 25 years, including as head of enterprise architecture for VF Corporation. Our Chief Information Officer holds an MBA along with various industry certifications, including SAP Enterprise Architect certification and TOGAF certification.


text: Furthermore, management of Hanesbrands prepares, and the Audit Committee reviews and discusses, an annual assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated annually and is designed to bring to the Audit Committee's attention our most material risks for evaluation, including cybersecurity risks.