text: Our Information Security Program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology ("IT") environment; • Regular testing of our systems to identify and address potential vulnerabilities; • Integrated planning and preparedness activities supporting business continuity and operational resiliency; • Security teams principally responsible for managing (1) our annual cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; •24/7 monitoring and measurement of cybersecurity threats through our PayPal Cyber Defense Center ("CDC");


text: • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • An information training and awareness program for our employees, contractors, incident response personnel, and senior management; and • A third-party risk management framework designed to monitor and address risks from cybersecurity incidents of service providers, suppliers, and vendors that includes due diligence over third-party's information security and technology control environment at onboarding and periodically throughout the lifecycle of the relationship. In addition, our standard contractual terms require notification and communication from third parties in the event of a cybersecurity incident. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.

companyName: PayPal Holdings, Inc.

ticker: PYPL

secItem: Item 1C


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see "Item 1A. Risk Factors" under the captions "Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" and "Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business."


text: CYBERSECURITY GOVERNANCE Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management.


text: The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Our CISO has numerous years of experience at PayPal and other organizations building security products, managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to Board on topics relevant to their service as a member of our Board.


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: Our cybersecurity teams, in coordination with the CDC, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through the operation of our incident response plan and various other means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, as well as alerts and reports produced by security tools deployed in the IT environment. The CDC team oversees, identifies, and addresses security threats aimed at safeguarding PayPal employees, consumers, and merchants.


text: Our CISO organization is responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting policies for the management and oversight of risk. The organization monitors cyber regulation requirements, reviews impacts of new products and initiatives, conduct reviews of cyber assessments and testing activities and provides effective challenge to the FLOD risk management activities.


text: The three lines of defense model is designed to provide a structure for risk management in the first line of defense ("FLOD"), monitoring and guidance by the second line of defense ("SLOD"), and independent audit by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer oversees the Company's information, cyber, and technology security. The Enterprise Risk Management Organization provides second line monitoring and guidance. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our cybersecurity risk management and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.


text: CYBERSECURITY GOVERNANCE Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management. The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.


text: Our CISO is responsible for implementing the information security strategy, security engineering, enabling business partners, and securing customer data, digital assets, and payments. His organization also monitors cyber regulation requirements and reviews impacts of new products and initiatives. Our CISO has over two decades of experience as a cybersecurity professional, including as a CISO at PayPal and four other organizations including leading global financial services institutions and large scale U.S. government agencies (including within the Department of Defense). He has an extensive record of success shepherding digital transformation aligned with business goals, launching cybersecurity frameworks, building security engineering teams, ensuring protection of assets, data, privacy, and company reputation.


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to the Board on topics relevant to their service as a member of our Board.


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments, and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: Cybersecurity Risk Management and Strategic Approach The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.


text: Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.


text: Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.


text: Cybersecurity Governance Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors, senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA and has developed and introduced new information security and computer risk management programs based on National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they're a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it's a shared responsibility, woven into the fabric of our corporate culture.


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis of our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA, and has developed and introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they are a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it is a shared responsibility, woven into the fabric of our corporate culture.


text: As a company that provides managed support services and security solutions for client applications, databases and technology infrastructure, we are committed to protecting the confidentiality, integrity and availability of our and our clients' information assets. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. As described further below, we maintain a formal and comprehensive information security management framework based on the ISO 27001:2013 Information Security Management System standard and have implemented policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. Our Board, including the Audit Committee of our Board, and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Risk Management and Strategy Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance obligations are identified and addressed through a multi-faceted approach, which involves independent third-party assessments and testing, internal audit, IT security, governance, risk and compliance reviews.


text: To defend, detect and respond to cybersecurity incidents, we, among other things, invest in and deploy industry leading cybersecurity tools and platforms; conduct proactive cybersecurity and privacy reviews of software, systems, applications and third party vendors; develop applicable policies and processes; perform independent penetration testing to evaluate and test security controls; conduct employee training and testing; monitor emerging laws and regulations related to data protection and information security though a dedicated team of in-house attorneys with experience in privacy and security matters; and monitor and respond to emerging threats, implementing appropriate mitigating controls as necessary.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Vice President, Global Security, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.


text: We conduct post-incident reviews of our response to cybersecurity threats and incidents, in addition to evaluating the effectiveness of supporting recovery protocols. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply and formally attest to these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees annually, and it is supplemented by testing initiatives, including periodic phishing tests.


text: Regarding data privacy, in 2023, our Ethics & Compliance Department implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: As noted above, we have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Also as noted above, to ensure the confidentiality and integrity of data and to protect against security threats or data breaches, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and maintain and certify to a formal and comprehensive security management standard: ISO 27001:2013 Information Security Management System.


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors" (Part I, Item 1A of this Report).


text: Cybersecurity Governance The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity, as well as a member with cybersecurity training certifications, and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our GVP & Chief Counsel, Chief Ethics and Compliance Officer on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.


text: Beginning in the first quarter of 2024, the full Board, at least annually, and the Audit Committee of the Board, at least quarterly, will receive quarterly reports on our cybersecurity program and developments from our Vice President of Global Security. These reports will include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.


text: Our Global IT and Global Security departments are led by our Executive Vice President and Chief Information Officer, Gertrude Van Horn, who joined us in January 2024. Ms. Van Horn is a globally recognized, award-winning executive with over 40 years of experience in global IT leadership, information security, crisis management, strategic planning and decision-making. Her expertise spans a diverse group of industries including financial services, chemicals, global manufacturing and retail. Prior to joining us, Ms. Van Horn served in C-level and executive IT leadership roles for NCH Corporation, IntegraColor, Haggar Clothing Company, JOANN Stores, Office Depot, Victoria's Secret, American Express, and J.P. Morgan.


text: Our Vice President of Global Security, Darren Remblence, reports to Ms. Van Horn and is responsible for the development of strategic direction, execution, and day-to-day management of global security. Mr. Remblence has more than 20 years of international experience and expertise in information security, cybersecurity, physical security, IT operations, investigations, business continuity and disaster recovery. Prior to joining us, Mr. Remblence worked at PayPal Inc., eBay Inc., The London Clearing House Ltd, Centrica Plc. and DHL International (UK) Ltd. He also served 14 years in the British Royal Air Force, where he specialized in cybersecurity and counterintelligence. He received his Master of Science in IT security from the University of Westminster, London and holds CISM (Certified Information Security Manager) and CISSP (Certified Information Systems Security Professional) certifications.


text: Generally, the implementation, management and oversight of our cyber risk strategy involves participation and input from Company personnel across a range of functional areas, including our IT, Security, Privacy, Risk Management and Legal departments/functions. Our strategy is designed to incorporate awareness of cyber risk into our day-to-day operations and functions, including the maintenance and establishment of client relationships, operating expectations, contract negotiations, the obtainment of insurance coverage and evaluations of third-party service providers.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Chief Information Security Officer, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.


text: Regarding data privacy, in 2023, our Ethics & Compliance function implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated, including increased usage of emerging technologies such as advanced automation and artificial intelligence. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors " (Part I, Item 1A of this Report).


text: Cybersecurity Governance The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our Company's Ethics & Compliance function, on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.


text: T he full Board, at least annually, and the Audit Committee of the Board, generally quarterly, receive reports on our cybersecurity program and developments. These reports include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.


text: Our Global IT and Global Security departments are led by our Chief Information Security Officer (CISO), who also serves as the Senior Vice President and General Manager of our Rimini Protect and Rimini Watch solutions. In this role, he is responsible for providing strategic leadership and management of Rimini Street's internal information security and compliance team and programs, the Rimini Protect client-facing security services and solutions, and the Rimini Watch observability solution. Our CISO has over 25 years of experience in IT and security for private and public-sector organizations and expertise in strategic consulting services, risk analysis/risk mitigation, and compliance. Previously, he held roles developing and managing technology and security teams, operations, business development, client-facing programs, budgets, and compliance in highly diverse organizations including the Global 100, defense, healthcare, energy, financial, retail, and education industries. He holds a Bachelor of Science degree in Information Systems with a concentration in Internetworking from Strayer University in Maryland.


text: The Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.

companyName: Wingstop Inc.

ticker: WING


text: The Company also trains employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes computer-based training at hire, annual follow-up training and acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.


text: We also maintain a third-party risk management program that includes policies and procedures designed to oversee and manage the cybersecurity risks associated with our third-party service providers. The Company conducts risk assessments at the initial onboarding of vendors or service providers who have access to Company systems or data and, subsequently, at regular intervals in an effort to help determine the severity and scope of risks to Company systems, data and operations. In addition to implementing safeguards that attempt to minimize risks associated with a cybersecurity incident, the Company maintains disaster recovery and business continuity plans that include data backup capabilities. We also have incident response procedures designed to address cybersecurity events that may occur despite the safeguards we have put in place. Further, our incident response procedures and business continuity plans are also designed to assist in responding to breaches of any of our third-party service providers.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2023, the Company reinforced its business continuity plan in an effort to provide increased oversight of our third-party service providers and suppliers. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and regularly participates in joint meetings with the Audit Committee to discuss these matters.


text: Our Senior Director of Information Security and Data Privacy, who has more than 20 years of experience in information technology-related roles, including engineering, governance, and security, oversees our information security program and matters of risk relating to cybersecurity. Members of our Information Technology team periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.


text: As part of the Company's enterprise risk management program, the Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2024, the Company has continued to make strategic investments in both its technical and organizational measures to further enhance its security capabilities and planning for detecting, preventing, and responding to cybersecurity attacks. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and, as necessary, participates in joint meetings with the Audit Committee to discuss these matters.


text: Our Vice President of Information Security and Enterprise Information Technology ("CISO"), who reports to our Senior Vice President, Chief Information Officer ("CIO"), oversees our information security program and matters of risk relating to cybersecurity. Our CISO possesses more than 20 years of experience in information technology-related roles, including engineering, governance, and security, undergraduate and post-graduate degrees in information technology and security, and industry-recognized cybersecurity certifications. Our CISO and members of our Information Technology team, including our CIO, periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes using the cybersecurity risk framework published by the National Institute of Standards and Technology ("NIST") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President, Operations and our Vice President, Information Technology ("IT"), and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Specific measures include regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments. We conduct due diligence on and audits of key technology vendors, contract research organizations (CROs), and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics. We also regularly consult with outside advisors and experts. Their assistance helps us assess, identify, and manage cybersecurity risks, anticipate future threats and trends, and understand their potential impact on our risk environment.

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Vice President, Information Technology, as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third-party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Cybersecurity Risk Management and Strategy We believe cybersecurity is critical to advancing our company's mission to be the catalyst for massive, measurable, data-informed healthcare improvement. We face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized groups and challenges specific to the healthcare industry. Our clients and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal and compliance), as well as senior leadership and the board of directors, as appropriate.


text: Our cybersecurity program incorporates industry-standard frameworks (including third-party certification), policies, and practices designed to protect the privacy and security of our sensitive information. Our third-party certifications for certain Solutions include a HITRUST Common Security Framework certification (which includes standards from frameworks such as HIPAA, ISO, EU, GDPR, NIST, and PCI to provide risk-based certification for companies in the healthcare supply chain) and a Statement on Standards for Attestation Engagements 18 (SSAE 18) System and Organization Control (SOC) 2 report that evaluates our security program.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The enterprise risk management's annual risk assessment is presented to the board of directors.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity Governance Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Information Security Officer and Chief Compliance and Data Privacy Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II. The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based upon our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity Governance Our board of directors (Board) oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer (CISO) and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the Audit Committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.


text: The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CRISC, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics. Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Information Security team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II.


text: Risk management and strategy Planet Fitness recognizes the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Managing Material Risks & Integrated Risk Management Planet Fitness has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team works closely with our information technology ("IT") department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. These risks are captured and prioritized in a risk register.


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Planet Fitness engages with a range of external experts, including cybersecurity assessors, consultants, legal advisors and auditors in evaluating and testing our risk management systems. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Planet Fitness implements processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.


text: Monitor Cybersecurity Incidents The Vice President of IT Security and Sr. Director of Security implement and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risks from Cybersecurity Threats As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information, see Item 1A. Risk Factors.


text: The Board of Directors emphasizes and supports the management of risks associated with cybersecurity threats. The Board maintains a collaborative relationship with IT leadership to promote effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance.


text: Management's Role Managing Risk The Vice President of IT Security and the Chief Information Officer ("CIO") play a pivotal role in informing the Audit Committee on cybersecurity risks. These individuals have over two decades of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations, including global retail e-commerce and mobile-commerce brands. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and interim CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to Board of Directors The VP of IT Security, in his capacity, regularly informs the CIO, Chief Financial Officer ("CFO") and other executive team leaders of aspects related to cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors where appropriate.


text: Management's Role Managing Risk The Vice President of IT Security and the Chief Information Officer ("CIO") play a pivotal role in informing the Audit Committee on cybersecurity risks. These individuals have over two decades of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations, including global retail e-commerce and mobile-commerce brands. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Audit Committee conducts a review at least annually of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to Board of Directors The Vice President of IT Security, in his capacity, regularly informs the CIO, Chief Financial Officer ("CFO") and other executive team leaders of aspects related to cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors where appropriate.


text: We have a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our data and systems. We are also subject to mandatory cybersecurity regulatory requirements. Our risk management programs, which address both enterprise and energy commodity risks, provides for evaluating and addressing cybersecurity risks and cybersecurity compliance. As part of our evaluation of cybersecurity risks, we consider cybersecurity risks and threats related to use of third-party service providers. Depending on the third-party service provider, the services provided by such third party and the data stored or to which such third party has access, we require different cybersecurity protections and specific cybersecurity programs that the third party must maintain. Our Utility Members have their own independent cybersecurity programs and procedures.

companyName: Tri-State Generation & Transmission Association, Inc.


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer have multiple cyber-related certifications from nationally recognized organizations and a combined experience in cybersecurity of 30 years.


text: We interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities. We utilize third-party consultants to evaluate and test our cybersecurity preparedness and participate in national transmission grid security exercises that also address cybersecurity threats. Our security efforts are intended to address evolving and changing cyber threats. We operate a dedicated cyber security center with capabilities to monitor, detect, analyze, mitigate, and respond to cyber threats.


text: The Engineering and Operations Committee of our Board has oversight of our cybersecurity program and the risks from cybersecurity threats. The Engineering and Operations Committee is briefed quarterly with both oral and written reports on cybersecurity including cybersecurity risks. Our Board receives oral briefing on cybersecurity including cybersecurity risks no less than once per year and our Board is provided access to all written reports provided to the Engineering and Operations Committee.


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents of phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information and Technology Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. As of December 31, 2024, o ur Chief Information and Technology Officer and Chief Information Security Officer maintained multiple cyber-related certifications from nationally recognized organizations.


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents such as phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Cybersecurity and Data Risks."

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Cybersecurity Risk Management and Strategy Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. For example, we have implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.


text: We promote a company-wide culture of cybersecurity risk management intended to protect the confidentiality, integrity, and availability of our critical systems and the information contained therein. As part of our cybersecurity risk management strategy, our corporate information technology team collaborates cross-functionally with key business leaders within privacy, compliance, finance and operations, among others, to identify, assess, and manage cybersecurity risks relevant to our business. On a quarterly basis, led by the Chief Information Security Officer (CISO) and Privacy Officer, the cybersecurity and privacy governance committee meets, which comprises of our executive and regional leadership teams. This governance committee assists in discussing existing or emerging threats, prioritizing roadmap items and/or budgetary considerations for project work.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. Additionally, while we have insurance coverage in place that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Cybersecurity Governance Management is responsible for the day-to-day handling of risks facing our Company Our Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K under the heading "Cybersecurity and Data Risks."


text: Cybersecurity Risk Management and Strategy Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. Our cybersecurity program is predicated on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). At minimum, on an annual basis we measure ourselves against this framework and use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our strategic execution. W e have also implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.


text: Cybersecurity Governance Management is responsible for the day-to-day handling of risks facing our Company. Our Board of Directors as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at a minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the CRO provides the framework to identify and reduce risks that may materially impact the Company's business. As part of the CRO's enterprise risk management process, regular inquiries and discussions are held with the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.

companyName: LivaNova PLC

ticker: LIVN


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information to the CRO in their regular discussions. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information systems.


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cyber incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations or financial condition. As previously reported, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity consultants and coordinated with law enforcement. The Company continues to assess what information was impacted and to implement remediation measures to mitigate the impact of the incident.. While the Company has taken and will continue to take actions to enhance its information security framework, LivaNova cannot determine at this time the extent of the impact from this event on its business, results of operations, cash flows, or financial condition. For further information, please refer to "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting and changes in internal control over financial reporting, see "Item 9A. Controls and Procedures."


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also establishes year-over-year goals, security objectives, and priorities for the information security program.


text: On an annual basis, the CISO reviews the information security program achievements and reports to the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the information security policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the security program, and reviews corrective action to improve the program.


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, security incidents, user training statistics, and evaluations of user readiness to address cyber incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors – Risks Relating to the Company's Business and Operations."


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the legal and compliance teams work in tandem to provide the framework to identify and reduce risks that may materially impact the Company's business. As part of the enterprise risk management process, regular inquiries and discussions are held with, among others, the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information in connection with regular enterprise risk assessments. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information technology systems.


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cybersecurity incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing, security assessments, or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. As previously disclosed, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity experts and coordinated with law enforcement. The Company implemented remediation measures to mitigate the impact of the incident. The Company also assessed the nature and scope of the affected data, analyzed its statutory notification obligations, and notified affected individuals and regulators as required by applicable law. The incident has been contained, and the Company's mitigation efforts are considered complete, but any future cybersecurity event has the potential to materially affect the Company's results of operations, cash flows, and financial condition. For further information, please refer to "Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" and "Note 11. Commitments and Contingencies" in LivaNova's consolidated financial statements in this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting, and changes in internal control over financial reporting, see "Part II, Item 9A. Controls and Procedures. "


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Company's Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also reviews year-over-year goals, security objectives, and priorities for the Company's information security program.


text: On an annual basis, the CISO reviews the information security program achievements and reports with the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the Company's Information Security Policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the information security program, and reviews corrective actions to improve the program.


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, cybersecurity incidents, user training statistics, and evaluations of user readiness to address cybersecurity incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see "Item 1A. Risk Factors – Risks Relating to the Company's Business and Operations."


text: Cybersecurity Risk Management We have developed and implemented a cybersecurity risk management program intended to preserve the confidentiality, integrity and availability of Peloton's systems and information, including our Members' data, APIs and web and mobile applications. Our cybersecurity program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"). We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on protecting the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is also integrated with Peloton's broader enterprise risk management program, through which we manage business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: While no organization can eliminate cybersecurity risk entirely, we believe our cybersecurity program is reasonably designed to mitigate our cybersecurity and information technology risks. Our cybersecurity program is supported by our information security team, which is primarily responsible for identifying, monitoring and preventing cybersecurity threats and our data privacy team, which is primarily responsible for developing, creating, maintaining and enforcing privacy policies, standards and procedures. Our information security team reviews potential identified incidents through various internal and external resources; identifies potential or actual cybersecurity threats; evaluates and prioritizes threats based on severity; investigates and mitigates the cause and impact of such incidents; administers our documented response procedures with respect to any data breach; and implements safeguards to help prevent recurrence.


text: Education, training and preparedness are important elements of our cybersecurity program. Peloton requires new employees to undertake a cybersecurity training and provides regular training updates to other employees. Additional trainings are mandatory for those employees who handle confidential (including personal) information.


text: We perform due diligence regarding our third-party suppliers, service providers and other business partners. This may include requiring evidence demonstrating third parties' ability to meet our cybersecurity and data handling requirements. In addition, Peloton's business partners who process data are contractually obligated to notify us if they experience certain incidents impacting our or our Members' data. Our ability to monitor the cybersecurity practices of third parties is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, network or other cybersecurity assets owned or controlled by third parties.


text: We regularly perform internal testing and engage independent third parties to perform audits and assessments as we deem appropriate. For example, our alignment with NIST standards has been reviewed by an industry-leading auditing firm. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur. We continue to invest in our cybersecurity program and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "–Any major disruption or failure of our information technology systems or websites, or our failure to successfully implement upgrades and new technology effectively, could adversely affect our business and operations", "–Cybersecurity risks could adversely affect our business and disrupt our operations", "–Our business is subject to the risk of earthquakes, fire, power outages, floods, hurricanes, public health crises, ransomware and other cybersecurity attacks, labor disputes, and other catastrophic events, and to interruption by man-made problems such as terrorism and international geopolitical conflicts", "–We collect, store, process, and use personal data and other Member data, which subjects us to legal obligations and laws and regulations related to security and privacy, and any actual or perceived failure to meet those obligations could harm our business", under the heading "Risk Factors—Risks Related to Our Business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance While everyone at Peloton has a role in managing cybersecurity risks, our Board of Directors and senior management team are actively involved in the oversight of our cybersecurity program. Our Board of Directors and the Audit Committee of our Board of Directors oversee Peloton's cybersecurity matters through regular reports and reviews, as well as reporting on material cybersecurity incidents. These include presentations by the Company's Senior Vice President, Chief Security and Trust Officer ("CISO") to the Audit Committee on a quarterly basis, along with ad hoc reports on cybersecurity incidents, threat detection and mitigation plans to the Audit Committee, our Board of Directors and our executive team.