text: The Information Security Department reports to the Chief Information Security Officer and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity efforts and recommendations are reported to the Risk Management Council no less than quarterly which is then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks. As noted, we employ a Chief Risk Officer, along with information security personnel in our Information Security Department. The Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership. See "Risk Management" in section of MD&A for an overview of our risk management framework.

companyName: FNB CORP/PA/

ticker: FNB


text: The Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness. Certain processes involve the use of third parties. A summary of each process is below.

secItem: Item 1C


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System or CVSS score, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, FNB relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions. These questions are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and deprovisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.


text: Network Security Management. The security of the FNB network infrastructure is maintained via • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks (VPN) to control remote access to our network, • intrusion detection capabilities, • network access controls (NAC) to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Event Monitoring. A centralized security monitoring team is responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The monitoring tool is third-party provided SIEM, and enables threat identification, detects suspicious activity in the environment using the MITRE Att&ck framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber incident is occurring or not.


text: Security Awareness. Annual training is conducted for continuing education for all employees. Routine phishing tests are administered routinely. We also post articles on our intranet of common attack schemes for our employee's awareness.


text: We have a Vendor Management department that established policies and procedures to follow when utilizing external third-parties. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process. Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. See cybersecurity risk factors in Item 1A. Risk Factors.


text: Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness.


text: The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity evaluation and recommendations established by the Information Security Department are reported to the Risk Management Council no less than quarterly, and the results are then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk. See "Risk Management" in section of MD&A for an overview of our risk management framework.


text: We believe our management has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, education, ongoing internal and external training and regular discussions with consultants and peers with applicable knowledge and expertise. See the following details of certain cybersecurity personnel.


text: The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls. The CISO is a Certified Information Systems Security Professional (CISSP). The CISO has a Bachelor's degree in Criminal Justice with a minor in Computer Science. The CISO is supported by several managers including the following: • Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience. • Manager of Security Architecture - CISSP with over 20 years experience in Information Technology networking, network security and security engineering.


text: The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.


text: A summary of the processes involved in our process of evaluating the effectiveness of information and cybersecurity controls is below.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to regular and routine vulnerability scanning, we rely on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. With the assistance of third-party vendors, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests review our customer facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions, the responses to which are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Network Security Management. The security of the FNB network infrastructure is maintained via: • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks to control remote access to our network, • intrusion detection capabilities, • network access controls to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Awareness. Annual security training is conducted for all employees, and routine phishing tests are administered routinely. We also post articles regarding common cybersecurity schemes on our intranet for our employees' awareness.


text: We have a Vendor Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins.


text: To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, see Item 1 of this Report, "Business – Cybersecurity" and Item 1A of this Report, "Risk Factors—5. Operational Risk—An interruption in or breach in security of our information systems, or other cybersecurity risks, could result in a loss of customer business, increased compliance and remediation costs, civil litigation or governmental regulatory action, and have an adverse effect on our results of operations, financial condition and cash flows."


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across the Company. Further, we may engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to the Company are brought to the attention of both the Chief Enterprise Technology Officer and General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.

companyName: FORD MOTOR CO

ticker: F


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee.


text: As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers have been the target of cybersecurity incidents and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to our networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 20.


text: Cybersecurity Governance and Oversight Cybersecurity risk identification, assessment, and management are integrated into our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Board.


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's critical business risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Chief Enterprise Technology Officer and Chief Information Security Officer monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's global cybersecurity incident response plans, which include provisions for escalation to the Chief Policy Officer and General Counsel, as well as the Board and its committees, as appropriate. As discussed below, the executive risk owners for cybersecurity risk report out to the Audit Committee and, in some cases, the Board, on a regular basis as part of our enterprise risk management process.


text: The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and Chief Policy Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to our operational information systems, security systems, vehicles, and services could reasonably be expected to affect the Company, including its business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 22.


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks, and have requirements for our suppliers to do the same. Data safeguard practices of suppliers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we do become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.

companyName: FORD MOTOR CREDIT CO LLC


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program leverages both internal and external techniques and expertise. Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals (often referred to as "white hackers" or a "Red Team") to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets. On a monthly basis, we disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and offer bounties to responsible third-parties who notify us of vulnerabilities they are able to detect in our cyber defenses (commonly referred to as a "Bug Bounty"). Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on external-facing endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring, running on primary public and private cloud environments; and • Disaster recovery and incident response plans, including a ransomware response plan.


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, Ford is a member of the Financial Services and Information Technology ISACs and both a founding member and board member of the Automotive ISAC. Ford's membership with these industry cybersecurity groups assists in the efforts to protect Ford and Ford Credit against both enterprise and in-vehicle security risks.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 6 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades leading digital and technology organizations at both enterprise software companies and Fortune 50 enterprises. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.


text: Cybersecurity risk management is an integral part of Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Once identified, each of the risks viewed as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.


text: As part of its oversight responsibilities, the Ford Credit Board receives annual cybersecurity updates from Ford's Chief Information Security Officer. The annual review includes oversight of cybersecurity practices, cyber risks, and risk management processes, such as updates to Ford Credit's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition, Ford Credit's Compliance Committee reviews at least annually Ford Credit's cybersecurity programs, and the Ford Credit Audit Committee receives updates on Ford Credit's cybersecurity initiatives and information technology internal controls. In addition to these regular updates, as part of Ford Credit's incident response processes, Ford Credit's Chief Technology Officer, in collaboration with Ford Credit's Qualified Individual and Chief Compliance Officer, provides updates on certain cybersecurity incidents to Ford Credit's Compliance Committee and, in some cases, the Ford Credit Board of Directors. In the event Ford Credit determines it has experienced a material cybersecurity incident, Ford Credit's Audit Committee and Chief Compliance Officer are notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers are the target of cybersecurity incidents, and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and Ford's in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to these networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 15.


text: Cybersecurity Strategy and Risk Management We devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. We believe our cybersecurity program is reasonably designed to protect our information systems, software, networks, and other assets against, and mitigate the effects of, cybersecurity incidents where unauthorized parties attempt, among other things, to disrupt or degrade service or our operations; misuse or abuse technology and information systems; make unauthorized disclosure of data; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are reasonably designed to reduce and mitigate these risks, and have requirements for our suppliers and service providers to do the same. Data safeguard practices of suppliers and service providers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers and service providers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by those parties. When we become aware that a supplier or service provider's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems.


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program is informed by and designed to comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The program leverages both internal and external techniques and expertise. Internally, we perform penetration tests, internal tests/code reviews, and Red Team exercises, among other things, to evaluate aspects of our cybersecurity program. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets, and regularly circulate security awareness newsletters to employees. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and operate a bug bounty program. The cybersecurity program also includes disaster recovery and incident response plans, including a ransomware response plan, which is regularly tested and evaluated in tabletop simulations.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 7 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades managing cybersecurity risks as a leader at enterprise software and Fortune 50 companies. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we have in the past and may in the future engage with third-party advisors and government and law enforcement agencies as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.


text: Cybersecurity Governance and Oversight Cybersecurity risk identification, assessment, and management are integrated into Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Ford Credit Board.


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to Ford and Ford Credit's operational information systems, security systems, vehicles, and services could reasonably be expected to affect Ford and Ford Credit, including their business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 18.


text: RISK MANAGEMENT AND STRATEGY 1st Franklin is committed to maintaining the confidentiality, integrity and availability of our data and information systems. We understand the risks presented by existing and emerging cybersecurity threats against our electronic infrastructure and the information it stores and processes, as well as against our customers and employees. We also recognize that there are cybersecurity risks associated with remote work environments which are utilized by some of 1st Franklin's employees, our use of cloud-based infrastructure and networks, and our use of third parties to support our operations.

companyName: 1st FRANKLIN FINANCIAL CORP


text: As a part of our overall risk management processes, we have implemented a comprehensive cybersecurity program designed to identify and manage cybersecurity risks. This program includes a robust risk assessment process designed to identify security vulnerabilities, incorporates regulatory requirements and also provides the foundation for the Information Security department's annually updated multi-year project roadmap, which is used to continually enhance 1st Franklin's cybersecurity program to respond to new threats and challenges.


text: We employ a comprehensive set of cybersecurity policies and guidelines and a strong security training and awareness program to communicate policy directives and current threats to 1st Franklin employees. Additionally, we have a strong due diligence and risk assessment process to identify and manage risks associated with our use of third-party service providers.


text: Some of the other features of our cybersecurity program include: • Monthly phishing simulations and additional training as required for incorrect identification of phishing attempts • Ongoing vulnerability scanning and annual penetration testing of our internal and external environments • IDS/IPS ( Intrusion Detection Device / Intrusion Prevention System) • Firewalls • Endpoint Detection and Response •24x7x365 Security Operations Center


text: • Security Incident and Event Monitoring • Cloud alerting and monitoring • Disaster recovery and business continuity planning and backup strategy • Incident response process • Network segmentation • Data classification labeling and data loss prevention • Privileged access management • Secure builds • Multi-factor and adaptive authentication • Physical security • Internet filtering, email spam filtering and anti-phishing • Brand protection and phishing takedown service • Database security • Data transfer and encryption Additionally, we maintain cybersecurity insurance coverage to help mitigate risk in the event of a potential breach or attack. Although we maintain insurance coverage at levels we deem appropriate for our business, it is possible that such coverage could be insufficient to cover all losses or types of claims that may arise.


text: We have experienced targeted and non-targeted cybersecurity attacks in the past, and we could experience similar attacks in the future. As previously disclosed, we suffered a cyber-attack against certain systems within our network environment in November 2022. The attack temporarily affected operations and caused delays in originating loans at some locations. During the incident, the attackers had access to the PII of certain Company employees, customers and investors. We contained the harm caused by the incident, quickly restored our business operations, and provided timely notifications to affected individuals, entities, and governmental agencies as required by law. Following the cyber-attack, we began undertaking significant remediation efforts and other steps to enhance our cybersecurity and data security infrastructure. Five (5) putative class action lawsuits were filed in the United States District Court in the Northern District of Georgia against the Company alleging harm from the cyber-attack. The Court consolidated all cases into one, and after extensive motion practice, administratively dismissed the consolidated case in full in January 2024. The Plaintiffs have asked the Court to reconsider its dismissal. To date, the Company's cyber insurance policy has covered and paid all material costs and expenses related to the class action litigation.


text: Other than as described above, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see "Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Leadership Team ("ELT") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the ELT, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board and with the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.


text: Our current CISO is a veteran security professional with over 30 years of information technology and information security experience. Prior to joining 1st Franklin, she worked at one of the largest banks in Canada and the U.S., where she was initially the Head of Application Security and later the Head of Cyber Innovation and Emerging Technologies. Prior to that, she also worked for two multinational banks in New York City in information security and information technology roles. The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers, a cybersecurity analyst and a VP of Information Security.


text: We have been, and in the future may be, the target of cyberattacks, including the previously disclosed November 2022 cyberattack on the Company and related data breach. We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see " Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Committee ("EXCO") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the EXCO, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board, the EXCO and the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.


text: The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers and a cybersecurity analyst.


text: Data and information systems are a key part of how the Company delivers value to its customers, employees and stakeholders, and the Company's cybersecurity program is committed to protecting its customers, employees, partners, infrastructure and systems. The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Senior Director of Global Information Technology Operations and Infrastructure who has expertise around global cybersecurity matters. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity and utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework as the foundation for its cybersecurity strategy and approach. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of Senior Leadership.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: A key area for the Cybersecurity Program is employee cybersecurity education. The Company's employees play a key role in cybersecurity and receive mandatory cybersecurity training, phishing attack simulations, educational events, and news bulletins. The Company's data protection and privacy program is designed to adhere to and adapt to global privacy and data protection laws.


text: The Company's business strategy, results of operations and financial condition have not been materially affected and are not reasonably likely to be affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but it cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on the Company's information technology related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company's data protection and privacy program is designed to help it assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. The Company designs its cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security, Inc (CIS) Controls, as guides in supporting its ability to perform such functions.


text: The Company manages its data protection and privacy program, fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework and CIS Controls, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments.


text: As part of the Company's data protection and privacy program, it maintains a cyber risk management program that seeks to address key risk management concepts, including mission and vision, escalation path for risk mitigation, risk assessments, and risk treatment. The Company does so by conducting a variety of planning and preparedness activities, including employing monitoring tools to identify suspicious or anomalous activity, vulnerabilities, or signs of compromise across its networks, systems, and data. The Company utilizes data from attack surface management tools to produce a prioritized set of vulnerabilities for remediation. A key area for the program is employee cybersecurity education. The Company's employees play a key role in cybersecurity and participate in mandatory cybersecurity training, phishing attack simulations, educational events, and receive news bulletins. The Company's data protection and privacy program is designed to adhere to and adapt to global privacy and data protection laws.


text: The Company has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If the Company experiences a cybersecurity incident, the Company activates an incident response plan, which includes processes to enable it to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Based on initial investigation into such incident's impact to the Company, the actor(s) involved, and other factors, the Company assigns a severity level to an incident, which dictates the escalation path for a given incident. Incidents rising to higher levels of severity and potential materiality are escalated to designated members of the Company's senior management for further assessment, response, and remediation. Additionally, the Company has established a Cyber Crisis Management Team, responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the Company continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.


text: The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Vice President, Information Technology. The Vice President, Information Technology reports to the Chief Administration Officer and has more than 25 years of IT experience with over 10 years of cybersecurity and international business experience. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity utilizing the NIST Cybersecurity Framework and CIS Controls as the foundation for its cybersecurity strategy and approach.


text: Risk Management and Strategy We recognize the importance of assessing, identifying and managing material risks from cybersecurity threats. Our cybersecurity program focuses on (i) identification of and protection from cybersecurity risks, (ii) detection and analysis of cybersecurity events, (iii) response to and recovery from cybersecurity incidents, and (iv) education and awareness. Under our program, designated personnel are responsible for: • assessing the severity of a cybersecurity incident and associated threat; • containing the threat; • remediating the threat, including recovery of data and access to systems; • analyzing the reporting obligations associated with the incident; and • performing post-incident analysis and program improvements.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Our cybersecurity team is led by our Chief Security Officer ("CSO") or the CSO's delegee partnering with our risk, technology, legal, compliance, privacy, human resources, and other applicable business teams.


text: Identification and Protection. Our cybersecurity program has established processes to identify and categorize cybersecurity threats and vulnerabilities as part of our risk identification process, pursuant to which we regularly seek to obtain, monitor, assess and respond to evolving threat and vulnerability information. Information about threats and vulnerabilities generally originates from multiple sources, including, but not limited to, government, information-sharing organizations, industry threat intelligence sources, and third parties. The identification of risks is supported through various security controls and testing to help minimize exposure to reported cybersecurity threats and vulnerabilities. These security controls include, but are not limited to, penetration testing, compromise assessments, vulnerability scanning, and various additional internal and external security audits and assessments. In addition, we maintain a third-party risk management program that includes an initial and periodic cybersecurity assessment on critical vendors' security posture and controls.


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event and sensitivity of any compromised data.


text: Response and Recovery. In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example forensic investigations, and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.


text: Education and Awareness. Our cybersecurity education and awareness program for employees and contractors covers a wide range of cyber topics including, but not limited to, policies and procedures, business/technology roles and responsibilities, threats and vulnerabilities, data privacy, confidentiality and asset protection. Our employees and contractors are required to complete mandatory initial onboarding and annual cybersecurity trainings, supplemented by other periodic cyber-related testing and training.


text: Our Board is responsible for the oversight of our cybersecurity risk management program. The Board has delegated to the Franklin Audit Committee oversight responsibility regarding cybersecurity risks. Our CSO reports directly to our Chief Risk and Transformation Officer, each of whom has extensive experience in information security and risk management. The Board and/or Audit Committee receive(s) a report on cybersecurity matters, including threats, events and program enhancements, at least annually. We update our cybersecurity policies at a minimum annually and benchmark our program to applicable cybersecurity standards and frameworks.


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2024, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies that are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event, including any operational impact and sensitivity of any compromised data.


text: Response and Recovery. In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities, which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example, forensic investigations and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2025, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, individual or brand impersonation, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Consumer Banking Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Technology Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: We employ an in-depth, layered, defensive strategy that embraces a "security by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, to the Technology Committee of our board of directors, and external agencies. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is responsible for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, information governance risk and compliance, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly (in the case of the Information Technology Risk Committee) and quarterly (in the case of the Information Security Oversight Committee) to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Technology Committee of our board of directors meets quarterly and is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: We employ a comprehensive cybersecurity risk assessment program designed to evaluate threats, vulnerabilities, and the potential impact on our operations, data, and financial condition. This program is regularly reviewed and updated to address emerging risks. Our process for addressing risk is based on banking industry best practices outlined in FFIEC and National Institute of Standards and Technology ("NIST") frameworks. We engage various third-party service providers in connection with our cybersecurity processes.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: We routinely engage consultants and other third parties to assist in the continued improvement and maintenance of our cybersecurity risk assessment program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address risks and vulnerabilities. Examples of these engagements include third party security assessments, security monitoring, and program review. We closely oversee and monitor third-party cybersecurity service providers.


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate risks. Our third-party oversight process follows published frameworks from NIST and FFIEC to account for risks throughout the entire engagement with our third-party vendors.


text: We consistently engage in proactive measures aimed at preventing, detecting, and effectively minimizing the impact of cybersecurity incidents. We maintain an incident response plan to swiftly respond to breaches, protect customer data, and minimize disruption to our operations. The incident response process is consistently tested and reviewed through simulated incidents and tabletop exercises with key stakeholders. To bolster our incident response process, we have robust business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident.


text: We have not experienced a material cybersecurity breach, but risks from cybersecurity threats may impact our business strategy, results of operations, and financial condition.


text: No risks from any current or previous cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, except to the extent that such strategy, operations, and conditions are affected by our employment of the cybersecurity risk assessment programs and procedures discussed in this Item. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of sensitive customer and employee data, we are susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events. We employ ongoing processes and strategies to guard against those threats, as discussed in this Item.


text: Cybersecurity Governance We recognize the value and importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.


text: Our Board of Directors and Chief Executive Officer, in collaboration with our Chief Information Officer and Chief Risk Officer, oversee cybersecurity processes, risks, and threats.


text: Rather than designate one specific board committee to cybersecurity risk management, our entire Board of Directors is responsible for overseeing our risk management. Our Chief Risk Officer is responsible for overseeing our risk management generally, working closely with our internal audit department. Our Chief Risk Officer regularly reports directly to the Board of Directors with respect to all areas of risk management.


text: With regard to cybersecurity specifically, we have a Cyber Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Cyber Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Cyber Information Security Officer delivers an annual report to our Board of Directors.


text: In addition, our entire management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, preventing, mitigating, and remediating such risks. We have an extensive and experienced team responsible for cybersecurity risk management.


text: Our current Cyber Information Security Officer has a comprehensive information technology background with over 20 years of experience in managing or assisting in managing cybersecurity risks.


text: To support the Cyber Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Cyber Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.


text: We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: a.24x7x365 Security Alert Monitoring e. Internal and External Security Assessments f. Security Awareness Training Programs g. Identity Management h. Incident Response Plans i. Data Encryption These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats. Our cybersecurity personnel provide regular reports to the Board of Directors.


text: As noted above, our Chief Risk Officer, Cyber Information Security Officer, and cybersecurity team provide regular reports to the Board regarding cybersecurity risks, as well as a review of the processes described above. In particular, our Chief Risk Officer provides reports at every regularly scheduled Board meeting regarding our most material risks and the degree of exposure to these risks. Our management personnel are also required to provide more frequent updates to the Enterprise Risk Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: With regard to cybersecurity specifically, we have a Chief Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Chief Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Chief Information Security Officer delivers an annual report to our Board of Directors.


text: Our current Chief Information Security Officer has a comprehensive information security background with over 20 years of experience in managing or assisting in managing cybersecurity risks across multiple industries with the majority of that experience at community banking institutions. Our Chief Information Security Officer holds multiple industry certifications from groups such as ISC2 and GIAC.


text: To support the Chief Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Chief Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.


text: As noted above, our Chief Risk Officer, Chief Information Security Officer, and cybersecurity team provide regular reports to the Board regarding cybersecurity risks, as well as a review of the processes described above. In particular, our Chief Risk Officer provides reports at every regularly scheduled Board meeting regarding our most material risks and the degree of exposure to these risks. Our management personnel are also required to provide more frequent updates to the Enterprise Risk Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen at a high level by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. TEGNA's internal Cybersecurity Council conducts quarterly meetings to discuss risks, processes, controls, strategy, and response. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.


text: We maintain third-party vendor policies and practices to identify, prioritize, and mitigate and remediate third party risk. Third-party access is narrowly limited in scope, granting access only to necessary systems with the lowest level of privileges required. Third-party access is monitored, and accounts are reviewed and attested to on a quarterly basis. TEGNA relies on third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: TEGNA has documented and tested incident response plans, which outline the steps to be followed from incident detection to containment, recovery, and notification, including notifying functional areas, as well as senior leadership and the Board, as appropriate. With assistance from third-party cybersecurity experts, TEGNA regularly conducts cybersecurity tabletop exercises with leadership and technical teams. TEGNA conducts compliance reviews of all cybersecurity policies and procedures at least annually and utilizes an outside cybersecurity firm to evaluate the overall program. Business units are required to attest to applicable TEGNA security controls monthly.


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have from time to time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see the risk factor entitled "Our efforts to minimize the likelihood and impact of adverse cybersecurity incidents and to protect our technology and confidential information may not be successful and our business could be negatively affected" in Item 1A. "Risk Factors".


text: Risk Management and Strategy Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management ("ERM") processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls and information systems.

companyName: GAP INC

ticker: GAP


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management and members of our Information Security, Information Technology and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plans and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain incident response plans to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.


text: Our cybersecurity risk management processes are based on industry-recognized standards. We partner with leading cybersecurity companies to leverage third-party technology and expertise, and we engage with these partners to support monitoring and maintaining the performance and effectiveness of controls implemented in our environment.


text: To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Data Privacy and Cybersecurity" in Item 1A, Risk Factors, of this Form 10-K.