text: Program Assessment We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery, and testing to validate patching and configuration. Additionally, our InfoSec function regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our CISO leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks in coordination with the EVP of Systems and IT Controls.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL

secItem: Item 1C


text: Our CISO regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our CISO regularly reviews enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: The cybersecurity ERM process is administered by InfoSec with input from each business segment and function. InfoSec continually monitors material cybersecurity risks facing Comtech, including cybersecurity threats and threats to our internal systems, our products, services and programs for customers, and our supply chain. Our cybersecurity risk management team has extensive experience leading information technology for global organizations across communications, aerospace and defense, and works directly with our CEO, Chief Financial Officer, Executive Vice President ("EVP") of Systems and IT Controls, and other members of senior management team to assess cybersecurity threats as part of our ERM process.


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.


text: During fiscal year 2025 and through the date of this filing, based on the information available, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Please see Cybersecurity Risks under Item 1A - Risk Factors under Part I of this Form 10-K for more information about risks to us from cybersecurity threats.


text: Enterprise Cybersecurity Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by us and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.


text: Cybersecurity for U.S. Government Authorized Systems Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual or "NISPOM") and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Program Assessment We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery and testing to validate patching and configuration. Additionally, InfoSec regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate or "CMMC" Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our cybersecurity risk management team leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks.


text: Our cybersecurity risk management team regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our cybersecurity risk management team regularly reviews and manages enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our cybersecurity risk management team regularly monitors and leads efforts to address and remediate, as appropriate, enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: Like other firms in the financial services sector, insurers like us are particularly vulnerable to cybercrime due to our large amounts of customer data. Insurance-related data is particularly interesting to cybercriminals because of its inherent confidentiality. Often linked to policyholders, sensitive data helps insurers customize their policies, products, and prices for each client. The scope of personally identifiable information and sensitive data processed by insurers puts the industry at increased risk of cybercrime. Cyber attacks can lead to the loss of confidential data, business, and reputation. Additionally, business disruption through cyber incidents is also a major problem for insurance companies, which need to react quickly to fulfill their contracts and maintain the trust of their clients. Because of the risks posed to our business and customers, we have developed robust processes for assessing, identifying and managing our cybersecurity threats.

companyName: CITIZENS, INC.

ticker: CIA


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things: perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our Information Security, IT, Finance, Compliance and Legal teams.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. We also conduct tabletop exercises to simulate responses to cybersecurity incidents.


text: Our risk management program also assesses third party risks, and we perform third-party risk management assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors. CITIZENS, INC.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Item 1A - Risk Factors - of this 10-K.


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. Cyber Governance.


text: Cybersecurity is a key element of the Company's enterprise risk management (ERM). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Vice President of Information Technology. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our CEO and a member of the Board, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, he has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives a information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.


text: Our risk management program also assesses third-party risks where we identify and mitigate risks from third-parties such as vendors, suppliers, and other associated business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Part I. Item 1A. Risk Factors of this 10-K.


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. CITIZENS, INC.


text: Cyber Governance Cybersecurity is a key element of the Company's enterprise risk management ("ERM"). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Chief Information Officer. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third-party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA"), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our former Chief Executive Officer and now a member of the Board of Directors, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives an information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Global Chief Information Officer has over 35 years of relevant industry experience, including over 29 years at our Company. Our Senior Director of Information Security functions as our Chief Information Security Officer and has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and senior management receive periodic briefings from the Global Chief Information Officer and the Senior Director of Information Security, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: The ERM Program is a proactive and ongoing process led by our legal and risk professionals and senior management, to identify, assess and manage risks and to build out and track mitigation and reduction efforts. The Board has tasked the Audit Committee with overseeing, reviewing and discussing with management, the internal audit team and the independent auditors, our ERM Program, policies and procedures with respect to, among other things, the assessment and management of risks related to our cybersecurity and information security and the steps management has taken to monitor and control such risks.


text: The Audit Committee is also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee provides another level of cybersecurity oversight through engagements at each Audit Committee meeting with senior management, including our Global Chief Information Officer and the Senior Director of Information Security. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Audit Committee regularly reports to the Board regarding these matters.


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements.


text: In addition, we operate a third-party cyber risk management capability which monitors the exposure of significant IT suppliers, significant software as a service suppliers and major vendors with access to our IT systems. We also monitor for significant changes in our cybersecurity risk posture and attempt to remediate the risk through collaboration with that partner. We also monitor for known breaches of the IT supplier landscape.


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").


text: The Audit Committee and its Technology Subcommittee are also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee and its Technology Subcommittee provides another level of cybersecurity oversight through engagements at each Technology Subcommittee meeting with senior management, including our CIO and CISO. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Technology Subcommittee regularly reports to the Audit Committee regarding these matters. Further, the Audit Committee regularly reports to the Board regarding these matters, including the matters discussed at the Technology Subcommittee.


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements. Additionally, we operate an Artificial Intelligence ("AI") governance program to ensure proper risk management and regulatory compliance where applicable with this expanding capability; managing ethical, legal, cyber, data privacy and other technology risks associated with the use of AI and Generative AI technologies.


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $ 2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over seven years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: For many years, we have strategically invested in our cybersecurity programs across the organization, and we have developed and refined our processes for detecting, evaluating, and responding to potential cybersecurity incidents. In particular, we focus on our networks, applications, data, employees, and vendors with a comprehensive cybersecurity plan, informed by nationally recognized frameworks which we use to monitor and improve our program as compared to the framework controls. In addition to our ongoing monitoring, we engage a third-party advisor to perform cybersecurity risk assessments of our information technology security processes and implemented technologies. We have segmented our building networks so that they are separate from our corporate network, and using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across those networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we engage with our employees in a training and testing program through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery, and we also maintain a business continuity and disaster recovery plan (including a cybersecurity incident response plan) to reduce the risk and impact of business interruptions, across a range of disaster scenarios, including potential impacts from a cybersecurity incident. Our business continuity and disaster recovery plan and our cybersecurity incident response plan are reviewed at least annually, and we also periodically conduct tabletop exercises that include the CIO and key members of management.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT Team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our CIO reports on cybersecurity strategy, status of cybersecurity risk control efforts, and third-party cybersecurity risk assessments of our information technology security processes and implemented technologies to the General Counsel, Chief Accounting Officer, Chief Financial Officer, Chief Executive Officer, and our Audit Committee. Our full Board has access to these Audit Committee presentations, including any provided materials. In the event of any material cybersecurity incidents, these presentations would also include information regarding those incidents, including status of mitigation and remediation.


text: Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns (including data privacy risk management) and the steps management has taken to monitor and control such exposures with management. As part of this oversight, the Audit Committee reviews the results of a biannual risk assessment designed to identify and analyze risks to achieving the Company's business objectives, including material risks from cybersecurity threats. The results of the biannual risk assessment are discussed with management and used to develop the Company's internal audit plan.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, Risk Factors in Part I, Item 1A.


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over eight years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze, and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, see Risk Factors in Part I, Item 1A.


text: Material Cybersecurity Risks, Threats and Incidents To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.

companyName: CUMMINS INC

ticker: CMI


text: Cybersecurity Governance We are committed to protecting our Information Technology (IT) assets and the data stored within these assets. This commitment includes the protection of IT assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.


text: The Cummins Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who has more than 25 years of information technology, IT architecture and operations experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating the status of key cybersecurity activities such as email phishing, event logging and data encryption. Information regarding relevant cybersecurity training is provided as well.


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Executive Director – Corporate Product Cybersecurity and Functional Safety, who has more than 35 years of automotive industry and electronic controls design experience. The Executive Director – Corporate Product Cybersecurity and Functional Safety reports to our Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, including the prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.


text: Our Board and its committees are engaged in the oversight of our most significant enterprise risks, including cybersecurity risks. We assign a member of our executive management team to report material information to our Board regarding these risks. The Audit Committee, working with the Chief Information Officer, provides oversight of the enterprise cybersecurity program. The SET Committee, working with the Chief Technical Officer, provides oversight of the product cybersecurity program.


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis, at least four times per year, and provide dashboards or reports, which summarize cybersecurity risks and action plans.


text: Cybersecurity Risk Management and Strategy We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly, at least four times per year, with our Chief Information Security Officer to review the cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents.


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Executive Director – Corporate Product Cybersecurity and Functional Safety to review the cybersecurity program, including risks and the status of key initiatives.


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. We have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function.


text: In addition, a cybersecurity operations team is in place, which monitors the environment for cybersecurity incidents on a regular basis. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. The Enterprise Cybersecurity MRG practices the incident response process through a tabletop exercise facilitated by external consultants. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.


text: We engage outside experts where appropriate to aid in developing and implementing the cybersecurity program and to review its operations. Our Internal Audit function also performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to enhance our cybersecurity operations to respond to the dynamic cybersecurity landscape.


text: Cybersecurity Governance We are committed to protecting our IT assets and the data stored within these assets. This commitment includes the protection of cyber assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.


text: The Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who holds a degree in Management Information Systems (MIS) and a Certified Information Security Manager (CISM) designation, and has more than 20 years of IT, cybersecurity, audit and risk management experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating cybersecurity priorities and the status of key initiatives.


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Principal Engineer – Product Cybersecurity, who has more than 35 years of embedded electronic systems design experience. The Principal Engineer – Product Cybersecurity works directly with the Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, and our prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis and provide dashboards or reports, which summarize cybersecurity risks and action plans. The committees elevate matters to the Board as appropriate.


text: Cybersecurity Risk Management and Strategy We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly with our Chief Information Security Officer to review the enterprise cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents. For material cybersecurity incidents, our process is to escalate through the MRG to the Audit Committee and Board.


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Principal Engineer – Product Cybersecurity to review the product cybersecurity program, including risks and the status of key initiatives.


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. Our risk-based cybersecurity program is designed to protect, detect, and respond to cybersecurity threats and incidents. This program, developed alongside the National Institute of Standards and Technology Cybersecurity Framework, aims to protect the confidentiality, integrity, and availability of our IT assets and the data stored thereon. We also have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function, and through this program, the company evaluates the type of data that is shared with certain vendors with the goal of conducting risk-informed assessments. These assessments provide insights which the Enterprise Cybersecurity function uses to better manage third-party risks.


text: A cybersecurity operations team is in place to regularly monitor the environment for cybersecurity threats and incidents. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.


text: We engage outside experts where appropriate to aid in maturing, implementing and testing the cybersecurity program and to review our cybersecurity operations. This includes incident response testing through tabletop exercises facilitated by external consultants. We have implemented training and awareness programs to educate our employees on cybersecurity risks, which includes regular educational phishing campaigns, and our Internal Audit function performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to develop and mature our cybersecurity operations to respond to the dynamic cybersecurity landscape.


text: Our Board is actively engaged in the oversight of the Company's cybersecurity, information security, data protection, and technology programs ("cybersecurity"). The Audit Committee of the Board, acting through its written charter, serves as the principal agent of the Board in fulfilling its oversight and review of the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. The Company's Chief Information Officer (CIO) leads the Company's cybersecurity risk assessment and risk management program. Our CIO, with over 25 years of experience leading cybersecurity oversight, brings a wealth of expertise and in-depth knowledge that is instrumental in developing and executing our cybersecurity program.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: Our cybersecurity program is fully integrated into the Company's overall enterprise risk management program. Our Vice President, Risk and Compliance (VP of Risk) facilitates the enterprise risk management program, and helps ensure that risk management is integrated into our strategic and operating planning process. The VP of Risk works closely with the CIO and his information technology security team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.


text: The CIO continually assesses industry best practices, frameworks, and standards, and leverages them to advance our cybersecurity program. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity risk management program includes the deployment of tools and activities designed to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents. Program highlights include: a. Employing a multi-layer strategy of defense designed to ensure the safety, security, and responsible use of information and data.


text: b. Monitoring of all IT assets, resources, and data 24-hours per day, 7-days per week, 365-days per year by security operations center (SOC). c. Performing annual testing of the Company's incident response plan and cybersecurity posture by a third party.


text: d. Incorporating external expertise to manage the SOC, perform penetration tests, cyber-attack simulation exercises, and log management to review anomalies indicating a possible breach. e. Maintaining a business continuity program and cyber insurance. f. Performing periodic employee simulated phishing campaigns.


text: g. Conducting annual cybersecurity and insider threat training for all employees. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to provide a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2023, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Intrusion on our systems could damage our business" in Item 1A "Risk Factors" of this Form 10-K.


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2024, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.


text: Set forth below is information regarding our cybersecurity risk management, strategy, and governance, along with a related description of our information security and data privacy practices.

companyName: TARGET CORP

ticker: TGT


text: Securing company systems, business information, and personal information of our guests, team members, vendors, and other third parties is important to us. We have systems in place to: • safely receive, protect, and store that information; • collect, use, and share that information appropriately; and • detect, contain, and respond to information security, cybersecurity, and data privacy incidents.


text: While everyone at Target plays a part in information security, cybersecurity, and data privacy, oversight responsibility is shared by our Board of Directors, its committees, and management.


text: Audit & Risk Committee Primary oversight responsibility for information security, cybersecurity, and data privacy, including internal controls designed to identify, assess, and manage risks related to these topics Management


text: Our Chief Information Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors CYBERSECURITY


text: Index to Financial Statements Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information Officer leads the strategic direction and management of Target's enterprise technology systems. He is responsible for Target's technology roadmap and oversees Target's global product engineering, infrastructure, cybersecurity, data sciences, and architecture teams. He has held a variety of leadership roles across the company and has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He continues to develop his expertise in these areas and contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity. • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process.


text: • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences.


text: Index to Financial Statements • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.


text: See "Information Security, Cybersecurity, and Data Privacy Risks" in Part I, Item 1A, Risk Factors for additional information regarding risks from cybersecurity threats.


text: Our Chief Information and Product Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information and Product Officer leads the strategic direction and management of Target's product and engineering teams. He is responsible for Target's enterprise technology systems and oversees Target's cybersecurity, data platforms, data science, infrastructure, product engineering, and enterprise product teams. He previously served as Target's Chief Digital and Product Officer and held a variety of leadership roles in enterprise technology and product management prior to joining Target. He has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity.


text: Index to Financial Statements • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process. • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences. • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee as part of its review of our ERM framework. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Information Officer and our Chief Information Security Officer. In 2023, the Audit Committee received briefings on information security matters at all of its regular meetings. In addition, our Chief Information Officer, our Chief Information Security Officer, other members of our information technology leadership team and an outside legal expert on cybersecurity matters held a special session with all members of our Board of Directors to provide an overview of the information security environment. In addition to information provided in these meetings, members of our Board also have access to internal and external education on cybersecurity risks. The Board also benefits from the expertise of one of our members who has significant experience in management of cybersecurity companies.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: Our information security team is led by our Senior Vice President & Chief Information Security Officer, who reports directly to our Executive Vice President - Chief Information Officer. Leadership of the information security team has extensive dedicated cybersecurity experience. Additionally, the collective leadership team holds 21 certifications in cybersecurity and related fields, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor.


text: Our Chief Information Security Officer and other members of our cybersecurity leadership team regularly participate in threat intelligence briefings provided through various government and industry entities. Both our Chief Information Officer and our Chief Information Security Officer are members of the Delta Risk Council, which is the management group that oversees all areas of our business risk. Cybersecurity threat risks are a regular subject addressed by this group. In addition, our Chief Information Officer is a member of the Delta Leadership Committee and provides updates to this group as needed about cybersecurity matters. Our cybersecurity incident response plan includes processes for communication about cybersecurity incidents to appropriate levels of management, including to the Risk Council and Leadership Committee, as well as the Audit Committee and the Board, as merited.


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee as part of its review of our ERM framework. The Audit Committee receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Information Officer and our Chief Information Security Officer at least twice per year with additional updates as requested by the Chair of the Audit Committee. In 2024, the Audit Committee received updates on information security matters at two of its regular meetings. In addition, our Chief Information Officer, our Chief Information Security Officer, other members of our information technology leadership team provided a general overview of information technology matters, including cybersecurity, in a special session with all members of our Board of Directors. In addition to information provided in these meetings, members of our Board also have access to internal and external education on cybersecurity risks. The Board also benefits from the expertise of one of our members who has significant experience in management of cybersecurity companies.


text: We are a trusted partner to enterprises of all sizes, and this is a responsibility we take seriously. The secure and uninterrupted operation of our networks and systems, as well as the processing, maintenance and confidentiality of the sensitive information that resides on our systems, is critical to our business operations and strategy. Each year, we process hundreds of millions of records containing data related to individuals and businesses. In addition, certain of our products are hosted solutions, and the amount of data we store for our customers on our servers, including personal, important business and other potentially sensitive information, has been increasing. Technology-based organizations such as ours are vulnerable to targeted attacks aimed at exploiting network and system applications or weaknesses. A successful cyberattack could result in the disclosure or misuse of sensitive business and personal information and data, cause interruptions in our operations, damage our reputation and deter clients and consumers from ordering our products and services. It could also result in litigation, the termination of client contracts, government inquiries and/or enforcement actions. Any of these events could have a material adverse effect on our business, prospects, results of operations and/or financial position.

companyName: DELUXE CORP

ticker: DLX


text: We have implemented a risk-based information/cybersecurity program dedicated to protecting our data and solutions. Our privacy policies, together with associated controls and procedures, provide a comprehensive framework to inform and guide the handling of data. We employ a defense-in-depth strategy, utilizing the concept of security layers and the CIA (confidential, integrity and availability) triad model. Our information security program is led by our Chief Information Security Officer ("CISO") and the Information Security department, which establishes the policies, standards and strategies to manage security risk. The CISO has more than two decades of experience with global technology organizations across multiple industries. We devote significant resources to addressing security vulnerabilities through enhancing security and reliability features in our products and services, providing employee security training, monitoring our operations 24 hours a day and 7 days a week, reviewing and auditing our systems against independent security control frameworks, and performing security maturity assessments. We may, from time to time, engage third-party consultants, legal advisors or audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents. These assessments inform our annual and multi-year cybersecurity strategies and our product security plans. In addition, our operations depend on a number of third parties, including vendors, developers and partners, that are critical to our business and to which we may grant access to our customer or employee data. We conduct due diligence on these third parties with respect to their security and business controls, and we have established monitoring procedures in an effort to mitigate risks related to data breaches or other security incidents originating from these third parties.


text: We have an Enterprise Risk Management Committee that is led by our Assurance and Risk Advisory Services group, our Chief Financial Officer and our Chief Administrative Officer, with participation from our executive leadership team and senior-level staff, including our Chief Compliance Officer and the CISO. This committee assesses and monitors our top enterprise risks, including cybersecurity, and provides quarterly updates to the board of directors. Our CISO also provides periodic updates to the finance and audit committee of the board of directors, which is responsible for ensuring that we have implemented appropriate risk reviews and discusses, with management and the board, our financial and enterprise risk assessment and risk management practices and policies, as well as reports to the board any material risks identified in the course of performing its responsibilities.


text: In the event a cybersecurity incident is identified, our Cybersecurity Incident Response team will act in accordance with our incident management plans to communicate to our executive leadership team and to coordinate the response to any incident. Our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology and Digital Officer, CISO and Chief Compliance Officer are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event. We maintain cybersecurity insurance coverage that insures us for costs resulting from cyberattacks, although this coverage may not reimburse us for all losses.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents see Item 1A, "Operational Risks – Security breaches, computer malware or other cyberattacks involving the confidential information of our customers, employees or business partners could substantially damage our reputation, subject us to litigation and enforcement actions, and substantially harm our business and results of operations."


text: We are a trusted partner for businesses of all sizes, and we take this responsibility seriously. Ensuring the secure and continuous operation of our networks and systems, as well as the processing, maintenance, and confidentiality of the sensitive information they contain, is vital to our business operations and strategy. We process records containing confidential data related to individuals and businesses. Additionally, some of our products are hosted solutions, and the volume of data we store for our customers, including personal, critical business, and other potentially sensitive information, has been growing. Technology-based organizations like ours are susceptible to targeted attacks that aim to exploit network and system vulnerabilities. A successful cyberattack could lead to the disclosure or misuse of sensitive business and personal information, disrupt our operations, damage our reputation, and deter clients and consumers from using our products and services. It could also result in litigation, the termination of client contracts, government inquiries, and/or enforcement actions. Any of these events would have a material negative impact on our business, prospects, results of operations, and financial position.


text: We have established a risk-based information/cybersecurity program dedicated to safeguarding our data and solutions. Our privacy policies, along with associated controls and procedures, provide a comprehensive framework to guide the handling of data. We employ a defense-in-depth strategy, utilizing multiple security layers and the CIA (confidential, integrity, and availability) triad model. Our information security program is led by our Chief Information Security Officer (CISO) and the Information Security department, which sets the policies, standards, and strategies to manage security risk. The CISO has over two decades of experience with global technology organizations across various industries. We allocate significant resources to addressing security vulnerabilities by enhancing security and reliability features in our products and services, providing employee security training, monitoring our operations 24/7, reviewing and auditing our systems against independent security control frameworks, and conducting security maturity assessments. We may also engage third-party consultants, legal advisors, or audit firms to evaluate and test our risk management systems and assess and remediate potential cybersecurity incidents. These assessments inform our annual and multi-year cybersecurity strategies and our product security plans. In addition, our operations rely on several third parties, including vendors, developers, and partners, who are critical to our business and may have access to our confidential data regarding consumers, employees, contractors, suppliers, and other business partners. We conduct due diligence on these third parties regarding their security and business controls and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from these third parties.


text: Our Enterprise Risk Management Committee, led by our Assurance and Risk Advisory Services group, Chief Financial Officer, and Chief Administrative Officer, collaborates with our executive leadership team and senior-level staff, including the Chief Compliance Officer and the CISO, to evaluate and oversee our primary enterprise risks, including cybersecurity. The CISO provides periodic updates to the board of directors, ensuring that comprehensive risk reviews are conducted and that our cyber risk assessment, practices, and policies are thoroughly discussed with management. Additionally, our Assurance and Risk Advisory Services group delivers periodic updates to the Audit and Finance committee of the board of directors covering financial and enterprise risks, including cybersecurity.


text: In the event of a cybersecurity incident, our Cybersecurity Incident Response team will act according to our incident management plans to communicate with our executive leadership team and coordinate the response. Our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology and Digital Officer, CISO, and Chief Compliance Officer are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs, and determining whether any prohibition on the trading of our common stock by insiders should be imposed before disclosing information about a material cybersecurity event. We maintain cybersecurity insurance coverage to cover costs resulting from cyberattacks, although this coverage may not reimburse us for all losses.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents see Item 1A, "Operational Risks – Security breaches, computer malware, or other cyberattacks involving the confidential information we maintain could significantly damage our reputation, expose us to litigation and enforcement actions, and substantially harm our business and results of operations."


text: Managing technology risks, including risks related to cybersecurity, is an integral part of Comerica's enterprise risk management framework and processes. As such, Comerica uses a library of processes, risks and controls to assess, identify and manage cybersecurity risks. Comerica measures such risks in part by estimating the likelihood and potential impact of incidents. Comerica seeks to manage such these risks by designing, documenting, and implementing controls, testing those controls through compliance assessments and internal and external audits and, in some cases, by transferring the risk in whole or in part through methods such as insurance. When an incident occurs, Comerica works to remediate the incident while complying with its regulatory obligations, and then evaluate the remediation for effectiveness. Comerica communicates on risk management matters through documented policies and procedures, management and Board committee reporting, and training and other employee communications.

companyName: COMERICA INC

ticker: CMA


text: For a description of how cybersecurity risks may materially affect Comerica's business strategy or results, see "Item 1A. Risk Factors." No cybersecurity threat risks during the fiscal year ended December 31, 2023 materially affected or were reasonably likely to materially affect Comerica's financial condition or results of operations.


text: Comerica engages information technology risk management employees with experience and expertise in cybersecurity. The organization consists of professionals in identity and access management, cyber defense operations, security engineering and information technology governance, risk and compliance. An Executive Vice President/ Chief Information Security Officer (with over 25 years' experience in cybersecurity risk management) and a Chief Information Officer (with over 27 years' experience in technology risk management) lead this team. Each reports directly to the Senior Executive Vice President / Chief Operating Officer, who reports directly to Comerica's Chief Executive Officer and the Board of Directors. In addition, Comerica engages third parties from time to time to assess, manage and respond to cybersecurity risks through risk assessment, penetration testing, incident response, threat intelligence, education, and managed security services.


text: Comerica also oversees and identifies risks from threats to third parties, such as service providers, through efforts such as monitoring, risk assessments, audits, contractual due diligence and third-party security standards.


text: Senior management at Comerica governs risk management and is informed about, and monitors the prevention, detection, mitigation and mediation of cybersecurity incidents, in part through working review committees on which our Chief Information Security Officer and/or Chief Information Officer serve. Each review committee receives risk management reports appropriate to its scope of review, covering matters such as assessment results, risk ratings and critical issues. They report significant matters to enterprise-wide risk committees overseeing the broad scope of risk management for the enterprise as appropriate. Through these and other efforts, senior management makes decisions and sets priorities in allocating resources to address risk management issues.


text: The Board's Enterprise Risk Committee oversees all of Comerica's risk management policies, procedures and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more often as necessary, to the Enterprise Risk Committee on technology risks, including risks from cybersecurity threats. The Board's Audit Committee and the Board as a whole also receive such reports as part of their risk management oversight roles. Board members have direct access to senior management (and others, at their request) on matters related to cybersecurity threats and may direct questions to senior management and request further information as they see fit to fulfill their oversight responsibilities.


text: Risk Management and Strategy. The Company has developed an information security program to assess, identify, and manage material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. An internal cyber risk assessment is conducted annually. The risk assessment is used by management to consider implementing and augmenting cybersecurity controls where feasible and appropriate with the intent of mitigating cybersecurity risk exposure. The Company employs a broad array of cybersecurity tools and controls to manage exposure to cybersecurity risks.

companyName: DILLARD'S, INC.

ticker: DDS


text: In addition, the Company retains third-party security firms in different capacities to provide some of these controls or monitor cybersecurity threats to our technology systems. For example, third parties are used to conduct independent assessments, such as vulnerability scans and penetration testing, and to confirm PCI DSS compliance. Additionally, third parties are also used to monitor security alert systems.


text: The Company engages with a number of service providers in connection with normal business operations. The Company uses a variety of processes to address cybersecurity threats related to third-party service providers, including, where appropriate, pre-acquisition diligence, and imposition of contractual data security and privacy obligations. In addition, the Company is a member of an industry cybersecurity intelligence and risk sharing organization and participates in other information sharing groups and trade organizations to stay abreast of ongoing cyber risks, cyber incidents, and newly disclosed vulnerabilities and attack vectors.


text: The Company utilizes multiple training methodologies to ensure associate awareness of cybersecurity risks and practices. Associates are required to undergo security awareness training when hired and annually thereafter. In addition, the Company conducts tabletop exercises and other readiness exercises to enhance incident response preparedness. Disaster recovery plans have been put in place, and are tested, to prepare for potential disruptions in technology on which we rely.


text: The Company has an Information Technology Governance, Risk, and Compliance function to address information technology risks, including cybersecurity risks. Additionally, a working committee of management meets periodically to review, assess, and manage material risks from cybersecurity threats.


text: The Company has written cybersecurity incident response plans that are reviewed, and updated if necessary, at least annually. The plans identify cross-functional incident response teams which are comprised of representatives from management, including the Chief Information Security Officer (CISO) and General Counsel. The plans provide for notification to the Executive Committee of the Board of Directors and the full Board of Directors, as appropriate, of any actual or suspected significant cybersecurity incidents and require regular updates to these parties during the investigation of such incidents.


text: The Company is unaware of any risks from cybersecurity threats, including those from publicly disclosed incidents with respect to other companies, that have materially affected, or are reasonably likely to materially affect the Company, including strategies, results of operations, or financial condition.


text: Governance. The CISO, who reports to the Chief Information Officer (CIO), is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The CISO has been with the Company for 40 years, is a certified CISSP, CRISC, and CIPM and oversees a team of experienced individuals. In addition to the working committee meetings described above, the CISO and CIO meet regularly with the Company's President and with other members of senior management to review the current state of the cybersecurity program and emerging threats to the Company.


text: Oversight of the information security program sits with the Company's President and ultimately with the full Board of Directors. The full Board of Directors is briefed as appropriate but not less than annually on cybersecurity risks and the Company's efforts to mitigate exposure from those risks.


text: Cyber threats are constantly evolving, and those threats and the means for obtaining access to information systems are becoming increasingly sophisticated. Cyber threats can come from unauthorized access, computer hackers, computer viruses, malicious code, ransomware, phishing, organized cyber-attacks and other security problems and system disruptions. The Company faces numerous attempts to access the information stored in its information systems. If successful, cyber incidents could expose the Company to loss or misuse of confidential information, including customer information, or disruptions of business operations. In addition, third-party service providers can experience breaches of their systems and products that impact the security of the Company's information technology systems and proprietary or confidential information. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate exposure to a particular cybersecurity risk, or if the control is not feasible or may have an adverse impact on operations. In addition, cybersecurity controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Risk Management and Strategy. The Company has developed an information security program to assess, identify, and manage material risks from cybersecurity threats, which is included in our overall risk management system and processes through a layered governance structure. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. An internal cyber risk assessment is conducted annually. The risk assessment is used by management to consider implementing and augmenting cybersecurity controls where feasible and appropriate with the intent of mitigating cybersecurity risk exposure. The Company employs a broad array of cybersecurity tools and controls to manage exposure to cybersecurity risks.


text: The Company is currently unaware of any risks from cybersecurity threats, including those from publicly disclosed incidents with respect to other companies, that have materially affected, or are reasonably likely to materially affect the Company, including strategies, results of operations, or financial condition.


text: Governance. The CISO, who reports to the Senior Director of Technology, is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The CISO has been with the Company for 40 years, is a certified CISSP, CRISC, and CIPM and oversees a team of experienced individuals. In addition to the working committee meetings described above, the CISO and Senior Director of Technology meet regularly with the Company's President and with other members of senior management to review the current state of the cybersecurity program and emerging threats to the Company.