text: Technical Safeguards: The Company uses an array of complex technologies and services to protect its information systems and employees from cybersecurity threats. Examples include firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. These safeguards are evaluated and improved through learnings derived from vulnerability assessments, penetration tests, and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has defined and maintains cross-functional incident response and recovery plans that will guide the Company's response to a cybersecurity incident. These plans are reviewed by senior management and are evaluated through tabletop exercises on a regular basis.

companyName: FUELCELL ENERGY INC

ticker: FCEL

secItem: Item 1C


text: Third-Party Risk Management: The Company uses a risk-based approach to identify and manage cybersecurity risks from third parties, including vendors and service providers. The focus of these efforts is to identify and mitigate threats that could impact Company operations.


text: Education and Awareness: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.


text: The Company engages third parties in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, vulnerability assessments, tabletop exercises, and other activities focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments influence the Company's tuning of cybersecurity policies, standards, processes and practices, the results of which are shared with the Board and the Audit Committee.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular updates on cybersecurity program key metrics, outstanding vulnerabilities, and emerging cybersecurity risks.


text: The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Global Vice President of Information Technology and Director of Cyber Security work in close partnership with the Company's senior leadership team to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. This collaboration work includes activities in support of the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and to report such threats and incidents to the Audit Committee and others when appropriate.


text: The Global Vice President of Information Technology earned a Bachelor of Science Degree in Management Information Systems from Western Connecticut State University and has served in various roles in information technology and information security for over 30 years, including serving in leadership roles of two large public companies. The Director of Cyber Security earned a Bachelor's Degree in Information Systems from Western New England University and has extensive cybersecurity leadership experience, including expertise in threat data analytics, digital forensics, and data recovery. Prior to joining the Company, the Director of Cyber Security formed and served as CEO of a successful incident response and cybersecurity consulting firm.


text: Impacts of Cybersecurity Threats To date, there have been no cyber security threats or incidents that have materially impacted our operations or financial condition. However, as a result of risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we continue to allocate substantial resources to sustain and enhance our cyber security capabilities, which allocation of resources has in turn materially affected our business strategy and processes. Despite these investments, we cannot be certain that the protective measures and processes implemented will be successful or adequate to counter all current and emerging risks and threats. A significant cybersecurity incident involving our systems and data, or those of our customers, business partners or vendors, could have a materially adverse effect on our business strategy, results of operations and financial condition.


text: We recognize the importance of developing, implementing, and maintaining processes for assessing, identifying and managing material risks from cybersecurity threats.

companyName: HURCO COMPANIES INC

ticker: HURC


text: Risk Management and Strategy We continue to invest in strengthening our cybersecurity strategy and platform and, as specifically set forth below, have integrated cybersecurity risk management into our broader enterprise risk management process. This integration will promote cybersecurity considerations as an integral part of our decision-making processes and operational practices. Our information technology department works closely with our senior management team to consistently identify, evaluate, and manage cybersecurity risks in alignment with our business strategy and objectives and operational needs.


text: We regularly monitor alerts from governmental authorities and industry experts, as well as third party system and organizational controls reports, to remain informed about prevailing and developing cybersecurity threats and bad actor tactics. We also periodically engage third party consultants to conduct independent assessments of our cybersecurity readiness and control effectiveness; to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices; and to inform our cybersecurity strategy. Further, we work with third party experts and leverage external resources to evaluate known vulnerabilities in existing systems and provide remediation steps, as appropriate, and/or otherwise further protect the organization from cyber risk or threats, in each case including cybersecurity threats associated with our use of any third-party service provider.


text: Based upon results of the foregoing, we deploy a wide variety of technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced endpoint detection and response, next-generation firewalls with intrusion detection systems, access and credential controls, and multifactor authentication. We have also developed, implemented, and maintain a cyber incident response plan, which is periodically reviewed and updated and includes procedures for addressing and recovering from cyber incidents while reducing the impact on the business and operations. This plan provides a framework for identifying, controlling, and mitigating the attack while reducing the recovery time and keeping the executive management team and Audit Committee of our Board of Directors informed.


text: Notably, our cybersecurity strategy and incident response plan intentionally prioritize frequent and automated backup and recovery processes in an attempt to minimize the potential for critical data loss and/or business interruption. In doing so, we use systems that provide immutable backup and recovery of files and virtual machines, encryption of data at rest and in transit to protect against unauthorized access, and transmission of copies offsite at predetermined, recurring, and frequent intervals.


text: The Audit Committee of our Board of Directors oversees cybersecurity risk management as part of its risk oversight function and oversees the design and effectiveness of management's implementation of our cybersecurity risk management program, procedures, and contingency plans. Senior management plays a critical role in informing the Audit Committee on cybersecurity risks. More specifically, the information technology department regularly informs executive management, including the Chief Executive Officer, Chief Financial Officer and General Counsel, on all aspects pertaining to cybersecurity risks and incidents; and the Audit Committee receives periodic reports from executive management, senior information technology leadership, and risk management personnel on our cybersecurity and information security risks and postures on a regular basis. These periodic reports include detailed updates on our activities preparing for, preventing, detecting, responding to, and recovering from cyber incidents, if applicable.


text: Senior management with primary oversight responsibility for day-to-day cybersecurity risk management includes our Chief Executive Officer, Chief Financial Officer, Director of Information Technology, General Counsel, Corporate Controller, and Chief Accounting Officer. The group's collective education and experience informs our cybersecurity risk assessment and management process and includes, among others, the following: higher education degrees (including master's level or equivalent) in computer science and/or technology; decades of experience in the information technology and computer science field; experience configuring and maintaining firewalls, VPNs, and endpoint security frameworks for sophisticated, multinational organizations; proficiency in programming languages; certifications as developers and network engineers; and responsibility for managing large-scale international implementations of enterprise resource planning software systems for global companies.


text: Risk Management and Strategy Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas. This integration ensures a holistic approach to risk management, enabling us to address cybersecurity risks in the context of broader organizational risks.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: We build and evaluate our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The NIST CSF offers a thorough set of guidelines and best practices to help us establish a strong cybersecurity posture. Utilizing the NIST CSF enables us to systematically identify, assess, and manage cybersecurity risks pertinent to our business operations. However, it's important to highlight that using the NIST CSF as a guide does not imply that our cybersecurity program meets any specific technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is grounded in a zero-trust framework and employs a multi-layered approach to ensure comprehensive protection. This approach includes:


text: Awareness and Training for Employees: We conduct regular phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats. These initiatives aim to enhance employee awareness and preparedness against potential cyber threats.


text: Security Tools and Technologies: We utilize advanced security tools and technologies, along with control policies and active review procedures, to strengthen authentication and access protection. This includes implementing multi-factor authentication, encryption, and continuous monitoring of network activities.


text: Third-Party Risk Management: We have established a rigorous third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information. This ensures that our partners adhere to our cybersecurity standards and do not introduce vulnerabilities into our environment.


text: Risk and Vulnerability Management: Our risk and vulnerability management program encompasses both proactive and predictive defenses. We regularly assess, remediate, and validate our security measures to address emerging threats and vulnerabilities. This includes conducting vulnerability scans, penetration testing, and threat intelligence analysis.


text: Managed Detection and Incident Response: We employ advanced endpoint protection and managed detection and response services to quickly identify and respond to potential security incidents. Our incident response team is equipped to handle various types of cyber threats and minimize their impact on our operations.


text: In evaluating the risks identified as a part of the annual assessment process, our information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk, including any potential impact on our customers and our employees. These risks are then prioritized and monitored by the information technology team.


text: We conduct periodic testing of software, hardware, defensive capabilities, and other information security systems to assess our cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, we consider both our individual risks and industry standards.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact on us, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.


text: The information technology department, led by our Director of Information Technology & Services ("IT Director"), is responsible for our cybersecurity program. The IT Director, along with a third party provider with significant cybersecurity experience, manages information security, infrastructure, and compliance. This collaboration ensures that our cybersecurity practices are aligned with industry standards and best practices.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Audit Committee receives briefings from the IT Director regarding our cybersecurity risk management program at least annually. These briefings include updates on our cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's management team.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Incident Response and Recovery Planning: CTO and the MSP have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan is tested and evaluated on a regular basis.


text: CTO and the MSP engage in the periodic assessment and testing of CTO's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of CTO's cybersecurity measures and planning. The MSP regularly assesses CTO's cybersecurity measures, including information security maturity, and regularly reviews CTO's information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and CTO will adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect CTO's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with written information security incident response plans adopted by CTO and the Company. These members of CTO's management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at CTO, the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented an information security and cybersecurity risk management program ("Program") intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems. Our Program takes a risk-based approach and is integrated into our overall enterprise risk management program. We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a benchmark to ensure that our Program is maintained in line with industry best practices. This does not imply that we meet any particular technical standards, specifications or requirements, but it does mean that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system. This means that if any business unit's systems are compromised, there is less risk that another business unit will be impacted by that event. This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.


text: periodic risk assessments and penetration tests, which are integrated within our enterprise risk management framework processes, designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any); annual management reporting to the Board;


text: reporting of the scope, objectives and results of internal audits on the procedures performed to validate the effectiveness of our control environment related to our information security systems and security controls to the Audit Committee at least two times a year;


text: annual cybersecurity awareness training, including phishing simulation campaigns, to educate employees on recognizing cybersecurity threats and preventing actions that could unintentionally grant unauthorized access to our systems;


text: deployment of endpoint protection software, supported by external managed services, to attempt to proactively detect and block malicious code from affecting our systems; a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess risk, monitor alerts, perform penetration testing or otherwise assist with aspects of our security controls and response to cybersecurity incidents; and a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.


text: Cybersecurity Governance Our Board maintains oversight responsibility relating to our Program, with assistance from the Audit Committee. At least annually, our management team (including the leaders of our Information Technology and Internal Audit teams) provides an update regarding our Program to the Board. This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year. The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any significant cybersecurity incidents.


text: Risk Management and Strategy The company maintains a multi-layered approach to cybersecurity risk management which leverages technology and human oversight. The company uses active and passive methods designed to continuously monitor information systems and assess, identify, and manage potential vulnerabilities and threats. This digital-security management process is integrated into the company's broader enterprise risk management framework.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: The company utilizes active monitoring techniques (e.g., penetration testing), designed to leverage multiple sources of threat intelligence and vulnerability scanning complemented by endpoint protection and network systems. The company has a rapid-response protocol designed to investigate system alerts of potential cybersecurity threats, and the company's incident response plan provides a structured approach to inter-departmental assessment, mitigation, and resolution of cybersecurity threats. The company conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program.


text: The company maintains strategic relationships with third-party cybersecurity experts and coordinates with various law-enforcement partners, each of whom may be engaged to provide additional investigative and remediation support. The company's senior security leadership conducts periodic, in-depth reviews with the company's enterprise risk management team and internal and external auditors to evaluate the effectiveness of the company's cybersecurity systems, controls, and management processes.


text: The company conducts a security assessment for potential suppliers and service providers, which includes detailed interviews, questionnaires, and cyber-risk scoring. This process extends beyond initial engagement, with ongoing monitoring to identify emerging security risks or changes in suppliers' risk profiles.


text: The company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the company under the heading "Cybersecurity incidents may hurt the company's business, damage its reputation, increase its costs, and cause losses," included as part of the company's risk factor disclosures in Item 1A of this Annual Report on Form 10-K. To date, the company is not aware of any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the company, including its financial condition, results of operations, or business strategies.


text: The Board of Directors of the company (the "Board"), primarily through its Audit Committee, oversees the company's cybersecurity program. The company's CIO and CSO regularly report to the Audit Committee on the current state of the company's cybersecurity program (including the current threat landscape, cybersecurity risks, and any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for enhancements that the Audit Committee deems appropriate.


text: The CIO and CSO receive regular reports from the company's cybersecurity department, both historical and real-time, about the company's global cybersecurity status. The company believes this approach enables the CIO and CSO to monitor the company's global security status and to identify and assess potential threats. The company has established written policies and procedures to ensure that cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). The company's security organization assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to the management team. If management determines a cybersecurity incident is material, the company's incident response plan and its disclosure controls and procedures set forth the process for any required disclosures and require management to promptly inform the Board.


text: Under the direction of the CIO, the CSO is responsible for global cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, physical security, fraud and security awareness and training. The CSO has over 20 years of security experience and holds a degree in IT and cybersecurity, along with maintaining certifications in risk, information security, data privacy, legal investigations, and audit, among other disciplines. The other members of the company's security organization also have extensive cybersecurity, business, and technology experience and all hold certifications in their area of expertise.


text: We also have a robust and rigorous oversight process for managing cybersecurity risks related to our third-party service providers. The process includes: conducting due diligence and background checks on the potential service providers; verifying their cybersecurity credentials, capabilities, and track record;

companyName: AGREE REALTY CORP

ticker: ADC


text: establishing clear and specific contractual terms and conditions regarding the Company's cybersecurity expectations, obligations, and the responsibilities of the service providers;


text: conduct quarterly business reviews of service providers including security operations performance and recommendations; and monitoring and auditing the service providers' performance, compliance, reporting and escalation procedures for any cybersecurity issues or incidents identified through quarterly business reviews.


text: Risks from Cybersecurity Threats While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - We face risks relating to information technology and cybersecurity attacks, loss of confidential information and other business disruptions " and "Item 1A – Risk Factors - The use of artificial intelligence presents risks and challenges that may adversely impact our business and operating results or that of our tenants ".


text: The audit committee has formal oversight responsibility for cybersecurity and is responsible for reviewing the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, the Chief Information Officer ("CIO") provides quarterly updates to the audit committee with respect to security improvement projects, cybersecurity incidents, mitigation, and management.


text: Management's Role Managing Risk Our CIO is responsible for developing and overseeing matters related to cybersecurity and serves as the Company's Chief Information Security Officer. The CIO has over 25 years of experience in information technology and is certified as an IT Business Relationship Management Professional (BRMP), Six Sigma Blackbelt and Lean Office Champion. The CIO reports directly to the Chief Operating Officer, who is accountable for the overall information technology and security strategy and governance of the Company.


text: In connection with improving the management of cybersecurity risk, the Company has: audited our systems with the help of information security consultants; completed ransomware simulations and enhanced our Disaster Recovery and Business Continuity Plan to reflect lessons learned;


text: implemented information security policies to monitor for and notify if personnel take potentially malicious actions against the company, such as forwarding sensitive emails or uploading data to non-approved cloud services; conducted recovery simulation of our proprietary database to determine restoration timing;


text: We do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See "Security breaches and other disruptions could compromise our information and expose us to liability, which could cause our business and reputation to suffer." in "Item 1A. Risk Factors" for additional information.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 15 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.


text: Our Vice President – IT oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.

companyName: Antero Midstream Corp

ticker: AM


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our Vice President – IT to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our Vice President – IT, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our Vice President – IT oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our Vice President – IT regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or similar role, which included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy distribution and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or in similar roles, which have included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy production, distribution, and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of the providers' criticality to its business and the providers' cybersecurity risk profile.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Human Resources and Technology Officer (the "CHRTO").


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CHRTO or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CHRTO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes the Company's CHRTO, who has more than 20 years of experience across various industries, and the Company's Director of Cybersecurity, who has 29 years of IT experience, including eight years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.


text: We assess, identify and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security team is directed at protecting all aspects of data and how information is stored, transmitted, processed and used in business processes.

companyName: Waste Connections, Inc.

ticker: WCN


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has served in that role with us since 2004 and has extensive experience with cybersecurity and information technology at the Company.


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology, including through the use of Artificial Intelligence (AI), in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology. Our Enterprise Risk Management Committee and our Vice President of Information Technology report to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity Governance reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity Governance has over 15 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.


text: For the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."

companyName: SKYWEST INC

ticker: SKYW


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any notable cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.

companyName: Blueprint Medicines Corp


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.


text: The information security team also has processes in place to inform and update management and, as needed, the audit committee about cybersecurity incidents that may pose significant risk to the company. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board and delegated to the Audit Committee. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: Trilogy Metals Inc.

ticker: TMQ


text: The Company uses a multi-layered, multi-vendor cybersecurity protection structure that focuses on user security and system and infrastructure security to mitigate cybersecurity threats such as unauthorized access, cybersecurity attacks and other security incidents. These and other potential security threats may damage or disrupt our hardware and software systems, lead to a loss of data or to the misappropriation of confidential information. To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior including, but not limited to: the use of antivirus software, restrictions on installing applications directly to users' machines, the deployment of internet browsing filters, remote access using a VPN client, multi-factor authentication, network firewalls and email protection.


text: Management is responsible for managing cybersecurity risks and bringing to the Board's attention any material risks. Under the oversight of the Audit Committee, the Company's Chief Financial Officer is primarily responsible for the assessment and management of cybersecurity risks and utilizes a third-party consultant to assist with managing these risks.


text: While we have never had a material cybersecurity incident that impacted our operations, from time to time we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from artificial intelligence, terrorist acts or other acts of aggression. Our customers and vendors may face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats, including an outside independent Cybersecurity consultant, a Security Incident Response Plan (SIRP) and periodic Information Technology training for all employees.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Effective incident response involves every part of our organization, including IT teams, legal, technical support, human resources, corporate communications, and business operations. Our Board of Directors oversees all business, property, and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.


text: Our CSIRT includes our independent outside cybersecurity consultant as our strategic lead and the consultant and Chief Financial Officer (CFO) lead the Incident Response Team. Our consultant is certified in cybersecurity and our CFO has overseen our IT for over twenty years. Our team meets at least annually to review the Plan, discuss simulations and appropriate actions, and update the Plan where necessary.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board of Directors and the Board's Audit Committee through our annual ERM assessment. Our cybersecurity policies and practices follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) maintaining the confidence of our customers, clients and business partners; (iii) preserving the confidentiality of internal and external information; and (iv) protecting the Company's intellectual property.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Information Security Risk assesses technology risks and controls, evaluates application systems' conformance to internally defined and approved security standards, coordinates audits and examinations for Information Technology ("IT") and Information Security, as well as tracks open risk issues and exceptions. IT Security defines security policies and standards, conducts security awareness and training, evaluates security configuration and assesses vulnerability risk.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Security Engineering plans, builds, and maintains technical controls and solutions that enhance our security posture that mitigate risk to the enterprise while assuring the integrity of the engineering design process.


text: Managing Material Cybersecurity Risks As a part of our overall risk management strategy, Information Security Risk conducts risk assessments on the technology environment as well as application systems implemented to support the various business functions of Hilltop based on the Gramm-Leach-Bliley Act guidance. Risks are identified from the Enterprise Risk Management and Internal Audit assessments of IT and Information Security. Information Security then quantifies the incidents and risks that have been identified and reports to the Operations & Strategy Committee, which is comprised of executives from across the enterprise representing disciplines including compliance, regulatory, information technology, risk, finance, and operations, if they meet certain thresholds. The necessary controls are identified to address the risk and this control evaluation contributes to the assessment of the residual risk value. In 2024, additional assessments were completed utilizing the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool for the enterprise.


text: Engage Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Hilltop engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements. In particular, each year we engage a firm to perform penetration testing. We do not allow the same firm to be engaged for more than three years in an effort to obtain diversity in methods of testing. Additionally, at least every two years, we engage a firm to perform a red-team exercise for a simulated cybersecurity event.


text: Board of Directors Oversight Our board of directors and the Risk Committee of the board of directors oversee an enterprise-wide approach to risk management, including cybersecurity risks, intended to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. The Risk Committee is central to the board of directors' oversight of cybersecurity risks and bears the primary responsibility for this function. The Risk Committee is composed of board members with diverse expertise including, risk management assisting them to oversee cybersecurity risks. The Risk Committee receives regular reports from our Chief Information Security Officer ("CISO") and provides updates to the full board of directors at each regular meeting of the board of directors. The Risk Committee also reviews all information security plans and policies, which are then recommended to the full board of directors for its review and approval.


text: Management's Role Managing Risk Our CISO plays a pivotal role in informing the Risk Committee on cybersecurity risks and developments. Our CISO provides comprehensive briefings to the Risk Committee on a regular basis, with a minimum frequency of four times per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events;


text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CISO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CISO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO. With over twenty years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our CISO is responsible for our Information Security Program and our information security leaders report directly to our CISO. We also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management, our CISO and information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our Information Security strategy and program, and daily Security Operations.


text: Monitor Cybersecurity Incidents Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CISO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, operational personnel, and members of the Board of Directors.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting key vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached, disrupted, or fail, we may incur significant legal and financial exposure and liabilities" under the heading Part I, Item 1A "Risk Factors".


text: Cybersecurity Governance Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, two members of the Board have been delegated authority to serve as initial points of contact for the Board in the event of a severe information security incident. The full Board receives a cybersecurity briefing from the CIO annually.


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication, and recovery plans in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: Our Board of Directors assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices, and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 25 years of technology leadership experience, including 19 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: Cybersecurity Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's team, including its Head of Risk Management and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service providers to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS


text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider; Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis;


text: Contractually obligating the provider to make us aware of significant cybersecurity related incidents; and Coordinating independent security assessments with the provider utilizing our own resources.


text: Cybersecurity Risk Management We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified.


text: We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents, which have capabilities to automatically isolate and terminate vulnerabilities. We utilize industry leading tools and controls for user management, authentication, and privileged access management.


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We periodically test, evaluate and refine our CIRP in response to identified risks.


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats.


text: Risks, Threats and Material Incidents As of December 31, 2024, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, we and our third-party providers have been the target of cybersecurity threats and expect them to continue. Notwithstanding the extensive approach we take to address cybersecurity, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A "Risk Factors" - Risks Related to Our Business and Operations - The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical IT Systems and information.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical IT Systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our former CIO left the Company in January 2025. Currently Shashank Patel, our Chief Financial Officer, is serving as Interim CIO as we proceed with an executive search to appoint a permanent CIO. Mr. Patel has been overseeing the Company's Information Technology function since he joined the Company in July 2018. References to the CIO and the CIO's duties refer to our CIO's historical role, Mr. Patel's interim CIO role, and our future CIO's role.


text: Mr. Patel has over 10 years of experience overseeing an Information Technology function. Our VP of Information Security has over 25 years of experience in leading cybersecurity functions across strategy, architecture, engineering, and operations.


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include, but are not limited to, risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is responsible for assessing our material, or reasonably likely to be material, risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.


text: Strategy, Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We have a Data Protection Office that works closely with, and assists, our enterprise Privacy Program, overseen by the Chief Privacy Officer, along with advisory support from appointed Data Protection Officers in Europe and Quebec.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, including within the last three years, these incidents have not had a material impact on our Company, including our business strategy, results of operations or financial condition. Risks from cybersecurity threats, including previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, are also not currently viewed as reasonably likely to materially impact our Company, including our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts and developments and technological advancements also increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Although we have implemented and maintain commercially reasonable security measures and safeguards, including to protect against and identify potential threats, these protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.


text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition as of the end of fiscal year 2024. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps.


text: Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of directors and our board committees.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services, to process and record financial and operating data and to collect and store sensitive data, including our proprietary business information and personally identifiable information of our employees and others. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices to attempt to identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. We require that our employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We have implemented processes to oversee and identify the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight and Management's Role Our Board of Directors has delegated the responsibility for the oversight of risks from cybersecurity threats and our cybersecurity practices to the Audit Committee. Our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Company's Chief Technology Officer ("CTO").


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. Our CTO focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts (collectively with the CTO, the "Technology Team"). Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across oil and gas, consulting, and power generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team, the Audit Committee and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C. "Cybersecurity" in their 2024 Form 10-K filed on February 20, 2025.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of Tripadvisor's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications and has worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data. Tripadvisor maintains rigorous standards for its information security leadership positions, including requiring extensive experience in building and leading cybersecurity teams and implementing enterprise-wide cybersecurity programs.


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process, including processes related to cybersecurity risks.

companyName: BALL Corp

ticker: BALL


text: Our information security team has established and implemented formal processes and policies to assess, identify, and manage risks arising from cybersecurity threats, including those associated with our internal operations and the use of third-party service providers. We continually refine our approach to address evolving cybersecurity regulations, identify potential and emerging security risks, and implement strategies to manage these risks. Ball has developed an incident response plan that includes a cyber incident materiality assessment with appropriate leadership governance. In addition, we have aligned our incident response plan with our enterprise risk and global crisis management processes.


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. In addition, we also augment and extend our cyber team using a select few trusted third-party partners that are integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous global cyber operations 24/7.


text: We are aware that there are potential cybersecurity risks associated with third-party service providers. Prior to engaging with third-party providers, Ball conducts thorough security assessments. We monitor for third-party cyber incidents and manage any third-party cyber incidents under our incident response plan and processes. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation. To date, we have not identified any cybersecurity incidents that have affected, or are reasonably likely to affect, our business, operations, or financial condition.