text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. We will tender claims in future periods for costs incurred as of December 31, 2023. The extent to which our insurance will cover such expenses remains uncertain. As of December 31, 2023, we had recovered $1.7 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 15 to our Audited Consolidated Financial Statements for additional information concerning the incident. As a result of our cybersecurity incident in 2023, our cyber insurance premiums increased significantly following renewal and the number of insurers that submitted proposals to us for consideration during our renewal process was very limited.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA

secItem: Item 1C


text: Our cybersecurity team is led by our interim chief information security officer ("CISO"), who directs a unified cross-functional team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at First Advantage. Our interim CISO has numerous years of experience at First Advantage and other organizations managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Collectively, the interim CISO and our cybersecurity team act in close coordination with senior leadership and other teams across First Advantage. In addition to our extensive in-house cybersecurity capabilities, we engage assessors, consultants, auditors, or other third parties to help assess, identify, and manage cybersecurity risks.


text: Our cybersecurity risk management process forms a critical component of our overall risk management and business strategy. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. Additionally, we utilize data encryption and access control, single sign-on and multi-factor authentication, and malware protection within our control environment. We also maintain a variety of incident response plans that are utilized when incidents are detected. These plans are designed to be flexible so that they may be adapted to an array of potential scenarios and provide for the creation of cross-functional cybersecurity incident response teams in the event of a cybersecurity incident. We regularly review our incident response plans and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident. Additionally, we require employees with access to our information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and General Counsel) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, our Chief Global Compliance Officer, and our General Counsel.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and related mitigation activities are also subject to oversight by the Audit Committee of our Board of Directors. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks, including management's response to any significant cybersecurity incidents. The Audit Committee receives regular reports, from our interim CISO and Chief Technology Officer, regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items, and reports to the Board of Directors at least quarterly.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Our business, brand, and reputation may be harmed as a result of security breaches, cyber-attacks, employee or other internal misconduct, computer viruses, or the mishandling of personal data" should be read in conjunction with the information above.


text: As trusted partners to healthcare providers, patients, biopharmaceutical companies, academic and non-profit institutions, business partners and employees, we appreciate the importance of maintaining a comprehensive and trustworthy information security program. Our information security program is fully integrated into our operations, and a hallmark of our program is its cross-functional approach with our internal privacy objectives and stakeholders.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the 14 domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and operate a vendor risk assessment program for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Head of Security, Privacy Officer, Chief Operations Officer, Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Our Head of Security is a senior information security professional with more than 20 years of experience implementing and leading security programs. Our Head of Security holds an undergraduate degree in computer science, has a Six Sigma certification in Total Quality Management and is a Certified Information Systems Security Professional ("CISSP").


text: Our board of directors is kept apprised of cybersecurity risks and assessments through regular presentations to the Audit Committee regarding our information security and privacy governance and reports on information security and privacy incidents. Cybersecurity threats, including as a result of any past cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see the "Risk Factors" section.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an integral part of risk management at the Company, and we and Hess share a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We rely primarily on Hess' cybersecurity risk management program and processes, including policies, controls or procedures, which includes a cybersecurity incident response plan as well as our own property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: Hess Midstream LP

ticker: HESM


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.


text: Our cybersecurity risk management program is integrated into the overall enterprise risk management program overseen by Hess' Chief Risk Officer, who also serves as our Chief Financial Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our and Hess' business risks, including financial, compliance, EHS and governance matters, among other topics.


text: The Company's and Hess' cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our services as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all Hess employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2023, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Cybersecurity Governance Our general partner's board of directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Company. The board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee primary responsibility for oversight of the Company's risk management practices, including oversight of cybersecurity and other information technology risks.


text: The audit committee oversees the implementation of our cybersecurity risk management program. The committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and Hess employee training activities. In addition, management updates the committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: We rely on Hess' management team – including the Chief Risk Officer, the Head of Information Technology and the Chief Information Security Officer ("CISO") – for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both Hess' internal cybersecurity personnel and retained external cybersecurity consultants. Hess' Chief Risk Officer, who also currently serves as our Chief Financial Officer, has nearly 20 years of experience in this role and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Hess' Head of Information Technology and Hess' CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, Hess' CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.


text: The management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Hess; and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Due to the critical risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

companyName: Repay Holdings Corp

ticker: RPAY


text: Risk Identification and Assessment We have adopted processes and procedures, including those described below to identify cybersecurity risks and events. Our CISO maintains a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business.


text: We have implemented hiring, onboarding and termination procedures that are designed to ensure our employees and contractors assist us in meeting our cybersecurity compliance objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.


text: We have implemented a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. We utilize a combination of third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. We also rely on these third party firms for educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.


text: As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors' financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.


text: Risks from Cybersecurity Threats While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See "Risk Factors" above.


text: Board of Directors Oversight Our board of directors established a technology committee (the "Technology Committee") to oversee the risks from cybersecurity threats. The Technology Committee is currently comprised of three independent directors and chaired by Maryann Goebel, who was awarded the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD). Our CTO works closely with the Technology Committee to develop the meeting agenda and to prepare the relevant materials for each committee meeting. The Technology Committee typically reviews an updated version of the cybersecurity risk assessment program (described above) at each meeting. The Technology Committee receives and reviews cybersecurity incidents that are reported in accordance with the SIRP and our other procedures. The Technology Committee typically meets on a quarterly basis. The Chairperson of the Technology Committee makes a regular report to our board of directors following each meeting of the Technology Committee. Our board of directors retains ultimate responsibility for the oversight of the major risks inherent in our business, including risks from cybersecurity threats.


text: Management's Role We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business. The Security and Privacy Steering Committee's responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices. The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer). The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department. Our CTO also currently serves as a member of the Security and Privacy Steering Committee.


text: Our CISO is responsible for managing any cybersecurity incidents under the SIRP and coordinating with our senior management. The SIRP includes a process under which senior leaders from our information security, legal and accounting teams will assess the impact and significance of a cybersecurity incident to determine any necessary external notifications or filings. The SIRP also contains parameters regarding the requirements and timing for notifications of certain cybersecurity incidents to our board of directors.


text: Our CISO has served in various roles in information security, information technology and engineering operations for over 25 years. Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school. He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2). Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years. Our CTO's prior experience includes serving as the Chief Information Officer and Chief Information Security Officer of a public company and as Chief Technology Officer of a separate public company.


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services, and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our Chief Information Officer ("CIO"), in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.


text: The cyber risk management program is overseen by our CIO, who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.


text: Our IT risk management processes are integrated into our Enterprise Risk Management ("ERM") program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our CIO and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies.


text: The Audit Committee of our board of directors ("Audit Committee") is responsible for the oversight of risks from cybersecurity threats and the process by which the board is informed about such risks. Our CIO reports to the Audit Committee on a periodic basis on data protection and cybersecurity matters. In addition, the Audit Committee receives regular updates on exposures, threats and mitigation plans directly from our IT department.


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate personnel, including our Head of Information Security, who reports to our Vice President, Information Technology, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train relevant personnel on these safeguards. These efforts are led by our Information Security group. All personnel are expected to engage in security awareness training. We engage third parties to perform security assessments to test our safeguards and, when appropriate, implement modifications to or add new safeguards based on the results of such assessments.


text: We generally require each of our relevant third-party service providers to implement and maintain appropriate security measures and to promptly notify us of any suspected breach of security that may affect our company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers and other members of senior management are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as well as through our audit committee.


text: Our Head of Information Security is primarily responsible for assessing and managing our material risks from cybersecurity threats. He has worked in various roles pertaining to cybersecurity for more than fifteen years and possesses a Certified Information Systems Security Professional (CISSP) certification.


text: Our Head of Information Security oversees our cybersecurity policies and processes, including those described above under "Risk Management and Strategy." The processes by which he is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: vulnerability management, third party risk management, data security management, security awareness training, systems management, operations security, security incident and event management, and incident response management. We utilize third parties for managed detection and active response to cybersecurity incidents.


text: Our Head of Information Security provides quarterly briefings to our audit committee regarding our cybersecurity risks and activities, such as any recent cybersecurity incidents and related responses (including those of third parties), if any, and cybersecurity systems testing. Our audit committee provides periodic updates to the board of directors that include any material information included in such briefings. In addition, our Head of Information Security provides annual briefings to our board of directors on cybersecurity risks and activities.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information and data that is proprietary, strategic or competitive in nature (together, "Information Systems and Data").

companyName: Akili, Inc.


text: Our information security team (with oversight from our Chief Information Security Officer ("CISO") and support from our head of information technology) helps to identify, assess, and manage the Company's cybersecurity threats and risks. Our information security team works to identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods including, for example, vulnerability scanning and monitoring and periodic testing and audits.


text: Depending on the environment, we have implemented various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, from time to time, vulnerability management, information classification and data protection, asset management, software patching processes and procedures, access control, encryption, back-up procedures, disaster recovery plans, training, executive oversight, event logging, endpoint detection, multi-factor authentication, continuous monitoring, audits and engagement of third parties to conduct analysis of our Information Systems and Data.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk assessment and our information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that we believe are more likely to lead to a material impact to our business. In addition, our senior management evaluates material risks to the Company, including material risks from cybersecurity threats against the Company's overall business objectives and reports to the audit committee of our Board, which evaluates our overall enterprise risk and related management of such risk.


text: In addition, we use third party service providers to perform a variety of functions throughout our business. As a result of such use of third party service providers, we face additional cybersecurity-related risks. We have a vendor management program designed to help us manage cybersecurity risks associated with our use of third party service providers. We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third party service providers. Third party service providers that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies or where the Company's anticipated use of such third party service providers may result, for example, in the provider's access or processing of certain Company information or data, are evaluated to assess their performance across several domains, including data security, operations management, and privacy. We seek to maintain effective communication with our third party service providers to facilitate timely notification of cybersecurity incidents that might impact the Company.


text: We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our overall business strategy, results of operations, or financial condition. While we have mitigating and compensating controls in place to protect against what we believe are some of the most significant types of cybersecurity threats that our business faces, such as ransomware attacks, denial of service attacks, theft of resources and unauthorized use or disclosure of customer data or confidential information, if such an event were significant and successful, it would be reasonably likely to materially affect our business strategy, results of operations, or financial condition by, for example, causing substantial disruptions to our product offering, services or support or incurring significant costs to mitigate and remediate the damage caused by such an attack. For information regarding cybersecurity risks that may materially affect our Company, see Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding cybersecurity and other risks we face.


text: Our Board has overall responsibility for risk oversight and has delegated to the audit committee primary enterprise risk oversight responsibility for overseeing the Company's risk assessment and risk management related to cybersecurity. The audit committee of our Board receives periodic updates from our Security and Privacy Council and/or Information Security team concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.


text: We have established a Security and Privacy Council (the "Council"), which as of the date of this Annual Report includes our CISO, Chief Legal Officer and other employees from our legal, engineering, information security, and information technology departments, which meets at least quarterly to review and evaluate information security and privacy risks and mitigations, information security resources and budget, audits, and monitoring programs. The Council includes certain members who have extensive experience assessing and managing risks from cybersecurity threats, including multiple decades of combined experience across information technology and information security positions; serving in leadership positions at other public companies; and having other significant experience in the areas of risk management, engineering, information technology, and information security.


text: Our management team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our business processes and our overall risk management strategy, and communicating key priorities to relevant personnel. Our management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy and procedures are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Members of management and other technical experts will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: Information technology systems, including our mobile or online platforms, mobile payment and ordering systems, loyalty programs and various other online processes and functions, are critical to our business and operations. The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors — The occurrence of security breaches and cyber-attacks could negatively impact our business." and "—Unauthorized access to, or improper use, disclosure, theft or destruction of, our customer or employee personal, financial or other data or our proprietary or confidential information that is stored in our information technology systems or by third parties on our behalf could result in substantial costs, expose us to litigation and damage our reputation."

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our information technology systems are protected through technological safeguards and management measures. We detect, identify, assess and mitigate cybersecurity risks by adopting standard risk management methodologies, which are developed based on the international cybersecurity management system standard ISO 27001 as well as the asset-oriented risk assessment framework. To minimize potential impact on business operations in the event of a cybersecurity incident, we have formulated, and regularly tested, our incident response plan. We also established a framework for data security and personal information protection, including measures to prevent data loss and detect and block abnormal accounts and activities, as well as systems and processes to prevent, detect and mitigate vulnerabilities. Our employees participate in regular cybersecurity training to enhance their awareness of cybersecurity risks. We engage in the periodic assessment of these processes and practices that are designed to address cybersecurity threats and incidents.


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001:2013 certification since 2018 for certain online business.


text: We have established processes designed to manage cybersecurity threats associated with the use of third-party service providers. These processes include security evaluations before third-parties' admission, ongoing oversight and assessment of their security status, and adopting necessary security measures at termination of services.


text: Our Board of Directors maintains overall responsibility for overseeing the Company's risk management framework, and cybersecurity represents an important component of the Company's overall risk management framework. The Board regularly reviews risks that may be material to the Company. The Audit Committee assists the Board in the oversight of cybersecurity and other technology risks. Through receiving regular reports from the Chief Technology Officer ("CTO") and the Chief Legal Officer, the Audit Committee discusses with management cybersecurity risk mitigation and incident management, and reviews management reports regarding the Company's cybersecurity governance processes, incident response system and applicable cybersecurity laws, regulations and standards, status of projects to strengthen internal cybersecurity management, the evolving threat environment, vulnerability assessments, specific cybersecurity incidents and management's efforts to monitor, detect and prevent cybersecurity threats. On top of that, significant cybersecurity incidents will be immediately reported to the Board in accordance with the Company's incident response plan.


text: Yum China Compliance Oversight Committee (the "Compliance Committee"), primarily comprised of leaders and representatives from our information technology, supply chain, legal, finance, HR and public affairs functions, as well as internal audit group, is responsible for assisting the Board and Audit Committee in overseeing the Company's cybersecurity risks. The Compliance Committee meets regularly to discuss legal and regulatory developments on cybersecurity, assess the Company's emerging cybersecurity risks and mitigation plans, and determine strategy to promote cybersecurity compliance. Through ongoing communications, the Compliance Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our CTO, as a member of the Compliance Committee, served various positions in the Company's information technology department for more than 20 years and began leading the department in 2017.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. The Company maintains cybersecurity insurance as part of its overall insurance programs.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, for example, periodic cybersecurity testing and cybersecurity awareness training for employees.


text: We retain a third-party technology solutions firm (IT Firm) to help identify, assess and manage the Company's cybersecurity threats and risks. The IT Firm reports to an employee in our finance and operations department, who functions as our IT lead (IT Lead) and who works with our management team, including our Chief Financial Officer (CFO). Our IT Firm identifies and, in conjunction with our IT Lead, helps assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods and tools.


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, to conduct risk assessments and identify potential risks.


text: We use third-party service providers to perform a variety of functions throughout our business, including manufacturing our product candidates and assisting with R&D and clinical activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.


text: We have integrated our assessment and management of material risks from cybersecurity threats into our overall risk management systems and processes. For example, the results of such third-party cybersecurity assessments are shared with our senior management and the board's audit committee for review, both of which evaluate our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk entitled "Our computer systems or data, or those of our collaborators or other contractors or consultants, maybe compromised, which could result in adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; significant disruption of our product development programs and our ability to operate our business effectively; reputational harm; and other adverse consequences."


text: Our IT Lead is responsible for engaging and overseeing our IT Firm. In consultation with our IT Firm, our IT Lead, Chief Financial Officer and General Counsel integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicate key priorities to relevant personnel, help prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Cybersecurity Incident Management Team, which consists of a representative from our IT Firm, IT Lead, Chief Financial Officer and General Counsel. In addition, our incident response policy includes reporting to our disclosure committee and audit committee of the board of directors for certain cybersecurity incidents.


text: Our audit committee receives periodic reports from our IT Lead concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and to address potential cybersecurity incidents that may materially affect our business.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the Collective Controls Catalog, in assessing the threat landscape and continuously monitoring our environment.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks. However, such risks and threats have not materially affected our business strategy, results of operations, or financial condition to date.


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.


text: Our cybersecurity organization, led by our Assistant Vice President of IT and our Director of Information Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Within our team, our current Director of Information Security has professional cybersecurity certifications. The Company's Board of Directors administers risk management oversight through the Audit Committee of the Board. Our Audit Committee receives quarterly updates about the effectiveness of the Company's cybersecurity and information security programs, vulnerability and threat detection, progress relative to the Company's cybersecurity roadmap, and the status of projects to strengthen our information security systems. The Audit Committee discusses with Company management and the Board the Company's processes with respect to risk assessment and risk management.


text: The Company relies on technology infrastructure and information systems, including the Internet and cloud services, to process, transmit and store electronic and financial information, manage a variety of business processes and activities, and comply with regulatory, legal and tax requirements. The Company also depends on its information technology infrastructure to capture knowledge of its business including its vessel operation systems, which contain information about vessel positioning and scheduling; monitor its vessel maintenance and engine systems; coordinate its business across its bases of operation including cargo delivery and equipment tracking; and communicate within its organization and with customers, suppliers, partners and other third parties. The Company's ability to service customers and operate vessels is dependent on the continued operation of these systems. While the Company takes various precautions and has enhanced controls around its systems, like other technology systems, they are susceptible to damage, disruptions or shutdowns, hardware or software failures, power outages, computer viruses, telecommunication failures, user errors, catastrophic events, or cyber-attacks including malware, other malicious software, phishing email attacks, attempts to gain unauthorized access to its data, the unauthorized release, corruption or loss of its data, loss or damage to its data delivery systems, ransomware, and other electronic security breaches. Over time, these attacks have become increasingly sophisticated and, in some cases, have been conducted or sponsored by "nation state" operators. The Company expects that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: The Company has implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to the Company's internal information systems and its services. The Board of Directors has direct oversight of the Company's risk management process and the management of cybersecurity risks. Under the direction and supervision of the Company's Chief Financial Officer, the Company conducts periodic risk assessments, which include cybersecurity risks. Senior management meets with the Board of Directors to review and discuss risk management on an annual basis. Management will provide a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant. The Company's Director of Technology, reporting to the Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats, and preparing updates for the Board of Directors. The Director of Technology has a combined twenty-one years of experience leading and working on cybersecurity teams at the Company and other companies in the oil and natural gas industry, has significant experience with networking, on-premises and cloud-based infrastructure, and cybersecurity controls, and has a Bachelor of Science degree.


text: In response to the increasing threats presented by cyber incidents, in April 2022 the Company established a Cybersecurity Committee, which meets regularly. This committee is comprised of the Director of Technology, members of management from the technology, quality, health, safety and environment and operations departments, as well as the Chief Financial Officer and the General Counsel, both of whom report to the Chief Executive Officer. The Cybersecurity Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Committee develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors and receives regular updates on cybersecurity-related matters.


text: The Company has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continuously evaluate and enhance its cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. The Company uses automated tools that monitor, detect, and prevent cybersecurity risks that are monitored by the technology department and a third-party vendor. As noted above, the Cybersecurity Committee is also implementing comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Committee escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, based on the materiality of the event.


text: When the Company experiences a cybersecurity incident, the Director of Technology will inform the Cybersecurity Committee, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and, in particular, whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors provides oversight of the Company's response to such incident. The Cybersecurity Committee continuously monitors incidents as they are remedied to ensure proper remediation and, if necessary, the ability to report to the Board of Directors if previously unknown material information arises during such remediation.


text: The Company engages subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor the Company's systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Committee oversees and establishes the parameters of the Company's engagement with these experts to ensure the Company obtains the supplemental assistance needed in this area, if any.


text: The Company's information technology systems are in some cases integrated, such that damage, disruption or shutdown to one system could result in a more widespread impact on the Company's systems as a whole. If the Company's information technology systems suffer severe damage, disruption or shutdown, and its business continuity plans do not effectively resolve the issues in a timely manner, the Company's business could be negatively affected. In addition, cyber-attacks could lead to potential unauthorized access and disclosure of confidential information, data loss and corruption (see "Item 1A. Risk Factors" under the heading "The Company relies on information technology, and if it is unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, its operations could be disrupted and its business could be negatively affected" of this Annual Report on Form 10-K. A cybersecurity incident could materially harm the Company's reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events.


text: Cybersecurity Risk Management and Strategy We have an established process led by our Chief Information Officer ("CIO") that governs how we assess, respond and report, internally and externally, the occurrence of cybersecurity incidents and threats. Typical incidents and threats are cataloged and reported to the CIO on a weekly basis together with details regarding the mitigation actions implemented as well as other possible mitigation actions that could be implemented to mitigate or prevent future similar incidents. Urgent or severe incidents are reported to the CIO immediately where triage then begins and does not end until the threat has been mitigated. Depending on the nature and severity of an incident, our process provides for escalating notification to our CEO and the Board including the Chairman of the Board, our Lead Independent Director and the Audit Committee chair. Otherwise, the Audit Committee receives quarterly reports that summarize the new threats identified over the quarter as well as threats that were mitigated over the quarter, with details on the quantity, severity, and addressability of the incidents.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: The Company has adopted the Center for Internet Security ("CIS") framework for cybersecurity defense. The CIS framework is a leading set of best practices for cybersecurity policies and procedures created by the non-profit Center for Internet Security, which are used or referenced by multiple legal, regulatory, and policy frameworks. The CIS framework includes: (1) a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems; and (2) a set of a recommended actions for cyber defense that provide specific and actionable ways to thwart the most pervasive attacks.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from penetration testing and bulletins published by CIS to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Incident and Event Management ("SIEM") system provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technologies, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program designed to identify, assess, and address potential risks from within the Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including spear phishing and other awareness training. • Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.


text: We regularly receive vulnerability threat information from our product vendors as well as CIS and other third-party sources. In order to prioritize mitigation efforts, we categorize threats based on likelihood of occurrence and the potential severity of an incident related to the threat. The Information Technology Department reports overall threat collection and mitigation status at least monthly to the CIO and at least quarterly to the Board and ERMC.


text: Cyber threats are discussed routinely (weekly, monthly, and quarterly) and ad-hoc based on the activities of that time. These threats are used to gauge the size and competency of the organization, the effectiveness of our tools, the sensitivity of the applications we use, and the security of the fundamental architecture that our system is built upon. This then drives decisions for staff, tools, and changes that may require capital or other funding.


text: We conduct third-party penetration testing on both a routine and ad-hoc basis. Routine penetration testing occurs at least annually and focuses on specific elements within our system, usually without notification to any of the Company's employees involved in those systems. Ad-hoc penetration testing occurs when we learn of a specific vulnerability of concern or when we resolve an alert from an imposing threat.


text: We also conduct table-top cyber exercises on an annual basis to ensure that the organization is prepared in the event that a significant breach actually occurs. These table-top exercises simulate a real cyber event (such as a ransom letter) in order to walk through the response process, gain information regarding how we react to incidents, identify areas of vulnerability, and recommend changes based on the outcome of the exercises.


text: While we have experienced cybersecurity incidents in the past, to date we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and continue to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. As discussed more fully under Item 1A – "Risk Factors", however, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. No matter how well designed or implemented our cybersecurity controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventative measures against cybersecurity breaches in a timely manner.


text: Cybersecurity Governance We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks, which includes engagement with both senior management and the Board. Our Board is responsible for overseeing our enterprise risk management activities in general, including those related to cybersecurity, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Further, the Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the CIO at least four times a year.


text: Our cybersecurity function is part of our Information Technology Department and is managed by our CIO who oversees the management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO has over 30 years of experience assisting IT leadership within the Department of Defense and other federal government agencies with IT architecture and solutions including cyber security. Within the Information Technology Department, these activities are orchestrated through cooperation between our cyber security group and our network engineering group. The individuals performing these functions include cybersecurity professionals with broad experience and expertise, including cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance and include professionals who are qualified as Certified Information Systems Security Professionals. The teams within our cybersecurity group and our network engineering group work together to: identify and mitigate risks; respond to active cyber activity on our networks; respond to recent activity publicized by the Center for Internet Security (CIS) or other reputable cybersecurity organizations; and respond to patches and updates provided by our vendors.


text: In addition, our Enterprise Risk Management Committee ("ERMC") considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is a cross-functional committee that reports to the Executive Leadership Team and is chaired by our Chief Financial Officer. The ERMC meets during the year at least quarterly and receives periodic updates on cybersecurity risks from the CIO, who is a member of the committee.


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to assess, identify, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: We perform risk assessments relating to cybersecurity and technology risks at least annually. Our cybersecurity risk management program has been developed based on industry standards, including those published by the National Institute of Standards and Technology ("NIST"). Highlights of the program include: • Corporate policies and procedures that guide our use of information systems, confidentiality and security strategy; • Identifying critical assets and high-risk threats, and implementing technical prevention and detection controls and response and recovery practices; • A third-party risk management process to assist in making risk-informed technology product and services decisions on third parties who provide, manage, store or have access to material data or information, including the completion of security questionnaires and independent assessments of controls, audits and/or contract terms; • Defined data loss prevention standards in place to detect and prevent data loss, including requiring third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices; • Security awareness training for employees to identify cybersecurity concerns and take appropriate actions; and • Evaluating our program's effectiveness by performing regular internal and third-party assessments of our controls, including external penetration testing and consultation on security enhancements.


text: Risks identified through our cybersecurity program are assessed to determine the potential impact and likelihood of occurrence and mitigation plans are developed and implemented accordingly.


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Steering Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, emerging threats and changes to industry standards, and incident reports and remediation, if any.


text: The SVP, IS, oversees processes for the regular monitoring of our information systems, including potential vulnerabilities. In the event of a cybersecurity incident, the IT organization and designated members of executive management follow an established Cybersecurity Incident Response Plan. This plan includes immediate actions to contain the threat, mitigate the impact and assess materiality, and requires retrospective review and identification of corrective actions to reduce future risk.


text: During the fiscal year ended December 31, 2023, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."


text: As a government contractor, GEO routinely processes, stores, and transmits large amounts of "Personally Identifiable Information". As such, we understand the criticalness of having a robust cybersecurity program that protects company assets as well as our clients' data. Our customers, suppliers, service providers, subcontractors, and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: GEO GROUP INC

ticker: GEO


text: The Board, through its Cybersecurity and Environmental Oversight Committee, oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), quarterly or as needed briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our current CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. In addition, our CISO has a certificate in Cybersecurity Oversight from the Carnegie Mellon University Software Engineering Institute. The corporate information security organization oversees, manages, and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture that supports information security, which we believe improves our cybersecurity.


text: The corporate information security organization has implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security controls. In addition, GEO has robust policies and procedures related to cybersecurity and general IT practices that include but are not limited to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. These initiatives are supported by a Managed Security Service Provider ("MSSP") that provides continuous intelligence and threat assessments, including such risks from cybersecurity threats associated with our use of any third-party service provider. Also, as part of the program, GEO engages third party cybersecurity organizations to perform bi-annual assessments of the environment. Identified cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment is presented to the Board.


text: Notwithstanding the extensive approach we take to prevent cybersecurity breaches, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse financial impact to our business. While GEO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. There have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect GEO, including its business strategy, results of operations, or financial condition.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Committee members receive presentations on cybersecurity topics from our Vice President, Information Technology & Facilities, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: Our management team, including our Sr. Director, Information Technology Operations and Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of security management in the Financial & Life Sciences industries.


text: As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program..


text: Since the management of cybersecurity risks is ultimately the responsibility of the Board of Directors, it devotes significant time and attention to the oversight of cybersecurity and information security risks, and benefits from the technical expertise of its members. The Board of Directors reviews an Enterprise Risk Position report that reflects key risk measures and trends across the Company, including cybersecurity. The Board of Directors also reviews and approves the Information Security Policy annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.


text: The Audit & Risk Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.


text: The Board of Directors is also responsible for the approval and oversight of the Information Security (IS) Program. Our Chief Information Security Officer (CISO), who is designated as the IS Program Coordinator, has extensive information technology, security and program management experience. The Information Risk and Controls Management Department, under the direction of the CISO, administers the IS Program with an objective of preventing cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team (ISIRT), which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.


text: All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture.


text: We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements.


text: We utilize third party service providers to support and facilitate business and operational activities and to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Third Party Risk Management framework, which provides the tools and practices utilized in the oversight of third party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FRB, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of Bank of Hawai i and other financial institutions.


text: For the 2023 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: For further information, please see our risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customer's confidential information ("Information Systems and Data").

companyName: Xometry, Inc.

ticker: XMTR


text: Our information security function, which is led by our Chief Technology Officer ("CTO"), helps identify, assess, and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including using manual and automated tools, analyzing reports of threats and actors, evaluating our risk profile, conducting audits, conducting threat and vulnerability assessments, and performing tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of certain data, access controls, employee training, penetration testing, cybersecurity insurance, systems monitoring and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports, as applicable, to senior leadership and the Audit Committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity consultants and software providers, managed cybersecurity service providers, penetrating testing firms, and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third-party manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider (such as by reviewing certain vendor's security assessments or reports) and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or those of our third-party partners or service providers or our data are or were compromised, we may experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruption to our business, harm to our reputation and brand, and exposure to liability."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including (i) our CTO, Mr. Leibel, who has previously served as the Senior Director of Engineering at various large technology companies and holds a Master of Information Technology degree from Virginia Tech; and (ii) our Vice President of Information Technology and Security, Mr. Brendan Hamilton, who has previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues and is a Certified Information Systems Security Professional.


text: Our Chief People Officer, CTO and recruiting personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management, including our CTO and Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, CTO, Chief Financial Officer, and General Counsel, who works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors receives such reports periodically from the Audit Committee and from our CTO. The board of directors also receive various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We conduct risk assessments to identify cybersecurity threats at least annually, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Innoviva, Inc.

ticker: INVA


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, legal, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage internal auditors and other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: During the year ended December 31, 2023, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."


text: Our executive team, primarily consisting of Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.


text: They oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which the executive team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • They provide briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. • In addition, they provide briefings of any significant cybersecurity matters to the board of directors as well as an annual update of cybersecurity risks and activities.


text: Our cybersecurity risk management and strategy program consists of cybersecurity-related policies and procedures, industry standard technology solutions including antivirus, firewalls and monitoring tools, awareness training for all employees, periodic testing, and insurance coverage. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: The audit committee of our board of directors is responsible for oversight the Company's cybersecurity risk. On the management-side, our head of information technology is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents. We have not identified any material cybersecurity incidents to date.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: Cyber Risk Management and Strategy We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following: • implementing the latest software releases and tools (including multi-factor authentication) in a timely manner; • seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers; • constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats; • third party internal and external vulnerability assessments and penetration testing; • annual review and audit of cyber controls and procedures; • periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology; • periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties; • security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements; • employee anti-phishing campaigns performed at least quarterly; • a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and • a cybersecurity risk insurance policy.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT