text: We, like others in our industry, experience cybersecurity incidents and attempts to access our systems. In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes. Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, or that past incidents are reasonably likely to materially affect us, we cannot provide any assurance that we will not experience a material incident in the future. As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A. Risk Factors for additional discussion of our cybersecurity risks.


text: Our Board of Directors (our "Board") has charged the Audit Committee with oversight of the Company's identification, assessment and management of cybersecurity and data privacy risks. The Audit Committee receives quarterly updates from our Chief Information Security Officer ("CISO") and our Chief Information Officer ("CIO") regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.

companyName: Bloomin' Brands, Inc.

ticker: BLMN

secItem: Item 1C


text: We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department. Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, BLOOMIN' BRANDS, INC.


text: Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our CISO reports directly to the CIO who has over 20 years of technology leadership experience in various industries.


text: Our CIO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly. In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.


text: We integrate technology into many aspects of our business. We use technology to engage with our customers and employees, and to deliver our products and services. The business information and data managed and stored in our technology systems is used in many of our daily functions, including accounting processes, financial forecasting, pricing, underwriting, sales, compliance, and communications, among others. We are mindful of the risk in the operation of our business presented by cybersecurity threats and remain aware of the potential risk to our IT systems and data.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: In anticipation and in response to such risks, we have a comprehensive information security/cybersecurity program, including controls and procedures designed to safeguard and maintain the integrity of our IT systems, and prevent and detect unauthorized access to our IT systems by threats or bad actors, both internally and externally. Due to the ever-changing nature of cyber threats, we seek to proactively mitigate risks through prevention and preparation. We take a risk-based approach and identify new and continuing threats to our information systems that could potentially compromise their secure and efficient operation. Our cybersecurity program is fully integrated into our overall risk management framework and is regularly evaluated by internal and external experts.


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who has over 25 years of relevant experience. Our CISO is charged with the maintenance and execution of our security program and reports to our Chief Information Officer, who leads the management of our information systems. The CISO manages a team that assesses, evaluates, and responds to cybersecurity threats. Our CISO, and other senior leaders in our IT, law, and internal audit departments, provide periodic reports to our Chief Executive Officer and other members of our senior management team and the Board, as appropriate, on cybersecurity risks and program updates.


text: Our Board oversees cybersecurity risks through the Board's audit and risk committees. The Board's Audit Committee has primary oversight of cybersecurity risk. In performing its oversight function, the Audit Committee considers information from the senior leaders in various departments (including the IT, internal audit and law departments) who provide periodic reports on cybersecurity, including updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we periodically engage third parties as part of our continuing efforts to evaluate, enhance and test the adequacy and effectiveness of our security measures and controls. We require our third-party service providers to implement and maintain comprehensive cybersecurity practices commensurate with the services they perform for us, and consistent with applicable legal standards and practices. In addition, we maintain and test a business continuity plan that is designed to allow us to continue to operate in the midst of certain disruptive events, including disruptions to our IT systems, and we have an incident response plan that is designed to address information security incidents, including any breaches of our IT systems.


text: We believe all of these functions serve the process of prevention, detection, mitigation, and remediation of cybersecurity incidents. While we have not experienced any material cybersecurity events, we believe that disruptions to and breaches of our IT systems are possible and may negatively impact our business in the future. Despite robust controls and safeguards in place, no system can guarantee complete security from internal and external threats. See Item 1A, "Risk Factors - We may not be able to prevent the unauthorized disclosure or misuse of confidential, personal or proprietary information."


text: We are not currently engaged in any substantive business activity except the search for potential assets, property or businesses to acquire, and we have no current plans to engage in any other activity in the foreseeable future unless and until we complete any such acquisition. In our present form, we are deemed to be a "shell company"

companyName: ATLANTICA INC

ticker: ALDA


text: seeking to acquire or merge with a business or company. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.


text: If and when we commence any operations, our board of directors will consider what they deem as a reasonable cybersecurity risk management program or formal processes for assessing cybersecurity risk.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1)

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Financial Officer is assigned oversight of cybersecurity risks. Our Chief Financial Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Strategy, Governance and Risk Management Reflect Scientific maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including the assessment of cybersecurity risks related to third-party vendors and suppliers. This program is integrated within the Company's enterprise risk management process and the results of the risk assessment, which occurs at least annually, along with mitigation strategies, are discussed with the senior management.

companyName: REFLECT SCIENTIFIC, INC.

ticker: RSCF


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security.


text: As a Company with a single-officer operation and no formal cybersecurity policies in place, we recognize the importance of safeguarding our digital assets and protecting sensitive information. While we strive to maintain the security of our systems and data, our resources and infrastructure are limited. We rely on basic security measures, such as password protection and firewalls to mitigate potential risks.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT


text: Given the nature of our operations and size, we may be more susceptible to cybersecurity threats. We acknowledge the possibility of breaches or unauthorized access to our systems, which could result in the loss or compromise of sensitive information. Any such incident could have a material adverse effect on our business, financial condition, and reputation.


text: We are committed to continuously evaluating and enhancing our cybersecurity measures as our business evolves. However, investors should be aware that our current capabilities may not fully address all cybersecurity risks. We encourage investors to consider the inherent risks associated with our limited resources and lack of formal cybersecurity policies when evaluating our Company.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyberthreats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.


text: Risk Management and Strategy We recognize the importance of assessing, identifying and managing risks from cyber security threats, and our processes to manage risks from cybersecurity threats have been integrated into our overall risk management framework.

companyName: Shutterstock, Inc.

ticker: SSTK


text: As a foundation of this approach, we have implemented a layered governance structure, and our privacy and cybersecurity risk management systems encompass policies, practices, and procedures for incident responses, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business including European Union General Data Protection Regulation (GDPR), UK Data Protection Law, the Brazilian General Data Protection Law (LGPD), the California Privacy Rights Act (CPRA) and other US state privacy laws, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: We annually undergo a Payment Card Industry (PCI) compliance certification process and obtain an attestation through a Qualified Security Assessor (QSA). We have an established bug bounty program and conduct penetration testing as needed to identify vulnerabilities for remediation. With respect to third party service providers, we obligate vendors to adhere to privacy and cybersecurity measures, perform risk assessments of vendors including their ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks, as we provide content licensing to customers in more than 150 countries and license content from contributors located in over 100 countries. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business including brand reputation, customer sales, legal impacts, and financial costs. While we have experienced cybersecurity incidents, to date, we have not experienced any material cybersecurity incidents.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as artificial intelligence, cloud computing, and machine learning may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology (IT) risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our group Chief Information Security Officer (CISO).


text: Our CISO, who has over 20 years of experience in cyber security and technology, oversees the implementation and compliance of our information security standards and mitigation of information security related risks. We also have management level committees and a cybersecurity incident team that support our processes to assess and manage cybersecurity risk as follows: • Privacy is co-chaired by the CISO and Assistant General Counsel. They bring IT, cybersecurity, legal, compliance and other function cross-functional members together as needed throughout the year to consider emerging technologies, such as artificial intelligence and emerging cybersecurity and privacy risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • Our Technology Leadership Team, which includes our group Chief Technology Officer, CISO, Technology Vice Presidents, and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives on a monthly cadence. • Our Senior Leadership Team including IT, operations, risk, legal and compliance leaders across business segments, meet quarterly to manage risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, these leaders review the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. • The Crisis Incident Management Team, which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Annually, this team assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options.


text: Each of these committees provides summary reports on their activities, which the CISO communicates as appropriate to the Audit Committee.


text: At the employee level, we maintain an experienced information technology team who are tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Risk Management and Strategy We maintain processes for assessing, identifying, and managing cybersecurity risks. These processes are designed to protect our information assets and operations from both internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, and to secure our networks and systems. Our cybersecurity and data privacy programs are aligned to, among others, the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage material risks from cybersecurity threats. We employ a combination of physical, procedural, and technical safeguards, regular system tests, incident simulations, and routine policy and procedure reviews to identify risks and enhance our practices.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: We have a cybersecurity incident response plan (CIRP) that we review on at least an annual basis and update as business needs and the security landscapes change and as required. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to our systems and networks, minimizing the impact on our stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management and the Board of Directors, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises on at least an annual basis to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: We provide our employees and consultants with privacy, data protection, cybersecurity incident response, and prevention education and awareness training, which includes annual and supplemental training covering relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform phishing test campaigns on at least a quarterly basis to reinforce identification and reporting training.


text: We engage third parties to conduct risk assessments on our systems and other vulnerability analyses on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics and penetration testing are utilized to identify potential vulnerabilities. To manage risks related to cybersecurity incidents that could impact our CROs, third-party vendors and other contractors and consultants, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers.


text: Cybersecurity Governance Our cybersecurity and data privacy programs are implemented and overseen by our Chief Information Security Officer ( CISO), our Senior Vice President (SVP) of Information Technology, and members of our executive management team.


text: Our SVP of Information Technology has over 20 years of information technology experience, with over 15 years of experience leading technology and cybersecurity programs in biopharmaceutical companies. Since joining Nurix in 2021, our SVP of Information Technology has led all information technology strategy and operations, including our cybersecurity program. Previously, he served as Chief Technology Advisor focused on cybersecurity incident response and strategic security consulting, and held senior IT leadership roles at multiple clinical-stage biotechnology companies. He holds industry cybersecurity certifications and is undertaking advanced studies in IT Management and Cybersecurity.


text: Our CISO has over 20 years of experience in information security, including more than 15 years of experience leading large-scale cybersecurity and privacy programs across various industries. He currently leads all aspects of our enterprise cybersecurity strategy, risk governance, and privacy effort. He holds industry-recognized certifications, including CISSP. He earned his MBA with a focus on Finance and Strategy and a B.E. in Electronics and Communication.


text: Our SVP of Information Technology and our CISO regularly provide cyber threat intelligence briefings to management on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. Our SVP of Information Technology and CISO also work closely with our Chief Financial Officer and Chief Legal Officer to further enhance incident response procedures and to assess and manage risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors (Audit Committee) oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. The Audit Committee provides periodic reports to the Board of Directors regarding its oversight of cybersecurity, information technology, data protection and related matters. Members of the Board of Directors also participate in table-top exercises involving simulated data security incidents and the Company's responses to those incidents.


text: The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, planned improvements to our cybersecurity program, and the status of information security initiatives. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Risk and Issues Disclosure As of November 30, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company, nor do we believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, we previously have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in our industry. We face risks of incidents, whether through cyber-attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware, and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Risks Related to Employees, Managing our Growth and Other Legal Matters—We depend on our information technology systems, and any failure of these systems, or those of our CROs, third-party vendors, collaborators or other contractors or consultants we may utilize, could harm our business. Security breaches, cyber-attacks, loss of data and other disruptions could compromise sensitive information related to our business or other personal information, prevent us from accessing critical information and expose us to liability, which could adversely affect our business, reputation, results of operations, financial condition and prospects."


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Partnership's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Partnership's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Partnership's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Partners, LP


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Partnership management. Management of Cybersecurity Matters The Partnership's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Partnership, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.


text: The SVP, E&O holds key skills, experience, and competencies related to the management of cybersecurity matters. In particular, our current SVP, E&O has over 30 years of experience leading IT and OT physical security and cybersecurity.


text: The SVP, E&O is supported by critical internal positions within the Partnership, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.


text: The Partnership's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Partnership's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Partnership's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.


text: The Partnership's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Partnership and assessing each vendor's level of access to the Partnership's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Partnership systems and information necessary to perform their service.


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Partnership's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.


text: As of March 15, 2024, the Partnership's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.


text: We are committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess, manage, and mitigate such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: Performant Healthcare Inc

ticker: PHLT


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to identify, assess, manage, and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments. We engage a third party expert to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. Additionally, from time to time, our internal audit function reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on vendors and other third-party service providers in the conduct of our business operations, and a cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Review of cybersecurity risks and internal audits regarding information security are conducted by the Audit Committee on a quarterly basis, or more frequently as determined to be necessary or advisable.


text: Our VP Information Security Officer (VPISO) runs our cybersecurity program. Our VPISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports to our Chief Financial Officer (CFO). Our VPISO and CFO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit Committee or the Board of Directors on our cybersecurity program and our efforts to identify, assess, manage, and mitigate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program designed to protect our systems and the confidentiality, integrity and availability of our data.

companyName: AbbVie Inc.

ticker: ABBV


text: We have implemented processes that are intended to assess, identify, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, evaluate, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.


text: We also have invested in tools and technologies to protect our and our patients', customers' and business partners' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees tools to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework and undergo a third-party assessment every two years to measure the maturity of our cybersecurity program against the NIST Cybersecurity Framework. In addition, we periodically engage third-party advisors to assess the effectiveness and capabilities of our cybersecurity program, strengthen our cybersecurity policies and practices and identify potential vulnerabilities of our systems.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personally identifiable information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personally identifiable information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. These relevant service providers are contractually required to notify us promptly of information security incidents that may affect our systems or data, including personally identifiable information. While we conduct due diligence on the security and business controls of our third-party service providers and take steps to monitor their compliance with our security requirements, we may not have the ability in all cases to effectively monitor or oversee the implementation of these control measures.


text: As of December 31, 2023, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."


text: Our board of directors has risk oversight responsibility for AbbVie and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the board of directors on its risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program, which is designed to be business aligned, risk-focused and multi-faceted to protect our and our patients', customers' and business partners' data. Our board of directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.


text: The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the board of directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management program. The Audit Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.


text: Our cybersecurity program is led by our Chief Information Security Officer, who is responsible for assessing and managing our information security and technology risks (including cybersecurity). He has more than 25 years of experience in information security and information technology risk management, holding chief information security officer positions with Fortune 500 companies in the retail, healthcare and life sciences industries. He has also served on the Health-ISAC board of directors and is a Certified Information System Security Professional (CISSP).


text: Our Chief Information Security Officer meets regularly with our information technology teams as well as other members of management to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer also provides similar topical updates to the full board of directors at least annually.


text: We have implemented processes that are intended to govern, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, detect, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.


text: We also have invested in tools and technologies to protect our and our patients' and customers' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for emerging threats and risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees information to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles and for business functions who may be impacted by a cyber incident. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer and other senior information technology executives also provides similar topical updates to the full board of directors at least annually.


text: Eaton follows the U.S. National Institute of Standards and Technology (NIST) Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, Eaton maintains documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Eaton's reactive processes are captured primarily by a cyber incident response plan (the IRP), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to Eaton's technology environment and are refined iteratively. Further, Eaton has an information risk management program that includes a vendor risk assessment process, whereby Eaton systematically oversees and identifies risks from cybersecurity threats related to its use of third-party service providers.

companyName: Eaton Corp plc

ticker: ETN


text: The IRP is executed by an Incident Response Team (IRT), led by our Chief Information Security Officer (CISO). The exact composition of the IRT varies depending on the severity and potential impact of an incident, and will typically include stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, external auditors, forensic accountants, and consultants who are on retainer contracts for expedited availability.


text: While cybersecurity threats remain a risk to the Company's business operations (see discussion in Item 1A. Risk Factors.), our robust risk mitigation strategies have been effective. Accordingly, no such threats have materially affected or are reasonably likely to materially affect the company, our business strategy, results of operations or our financial condition. Governance.


text: While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CISO, who reports to the Company's CIO. Our CIO reports directly to the Chief Executive Officer. Our CISO leads a robust team of dedicated professionals that are responsible for a wide range of risk assessment and management and leads at least ten specialized teams of internal and external experts focusing on distinct categories of threats.


text: Eaton's Board of Directors is trained annually regarding incident response and risk management. While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. The Audit Committee also participates in risk management training related to cybersecurity risk management specifically.


text: At Progyny, cybersecurity risk management is an integral part of our broader risk management system and processes. Our cybersecurity risk management program incorporates industry-standard frameworks, policies and practices designed to protect the security of our technology infrastructure and sensitive information.

companyName: Progyny, Inc.

ticker: PGNY


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters including material cybersecurity threats and incidents.


text: We have established and test our disaster recovery plan and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessment and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we maintain various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity programs, developments in cybersecurity and updates to our cybersecurity programs and mitigation strategies.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – If our information technology systems, or those of our provider clinics, specialty pharmacies or other vendors lag, fail or suffer security breaches, we may incur a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and the results of operations" in this annual report on Form 10-K.


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters, including material cybersecurity threats and incidents.


text: We have established and test our disaster recovery plan, and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessments and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we have implemented various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. T he Audit Committee is responsible for ensuring that management has processes in place that are designed to identify and evaluate cybersecurity risks to which we are exposed and has implemented processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is overseen by our Chief Information Security Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and cybersecurity team are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity program, developments in cybersecurity and updates to our cybersecurity program and mitigation strategies.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—If our information technology systems, or those of the third parties with whom we do business, including our provider clinics, specialty pharmacies or other vendors, lag, fail or suffer cybersecurity breaches, we may experience a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and results of operations" in this Annual Report on Form 10-K.


text: We are managed and operated by the board of directors and executive officers of MPLX GP, our general partner and a wholly owned subsidiary of MPC. Our general partner has the sole responsibility for providing the employees and other personnel necessary to conduct our operations, including processes for the assessment, identification and management of material risks from cybersecurity threats.

companyName: MPLX LP

ticker: MPLX


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team to identify, assess and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.


text: MPC engages with external resources to contribute to and provide independent evaluation of MPC's cybersecurity practices, including a periodical assessment of our cybersecurity program performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO") and the MPLX GP Audit Committee of the MPLX GP Board use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify, protect, detect, respond and recover from cybersecurity incidents.


text: MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third party risk assessment processes.


text: As of February 28, 2024, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company, including our business, operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that these events may occur and could have a material adverse effect on our business, operations or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO provides regular cybersecurity briefings to the MPLX GP Board of Directors and the MPLX GP Audit Committee as needed, with a minimum of two briefings per year. The MPLX GP Audit Committee further reviews and provides input on our cybersecurity and information security strategy.


text: MPC's CISO is responsible for the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Operations & Engineering, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing.


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers.


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing, and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team and overseen by the Board to identify, assess, and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.


text: MPC engages with external resources to contribute to and provide independent evaluation of its cybersecurity practices, including a periodic assessment of its cybersecurity program that is performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team, through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO"), and the MPLX GP Audit Committee of the MPLX GP Board, use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify cybersecurity threats and protect against, detect, respond to and recover from cybersecurity incidents.


text: The information systems, data, assets, infrastructure, and computing environments of MPC's third-party service providers are also at risk of cybersecurity incidents. MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third-party risk assessment processes.


text: As of February 27, 2025, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the Partnership, including our business strategy, results of operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that cybersecurity incidents may occur and could have a material adverse effect on our business strategy, results of operations, or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO are responsible for managing risks from cybersecurity threats. The CDO and CISO provide regular cybersecurity briefings to the MPLX GP Board of Directors including the MPLX GP Audit Committee, with a minimum of two briefings per year and additional briefings as needed. The MPLX GP Audit Committee also has direct access to the CDO and CISO and their management teams for other updates on cybersecurity and information security strategy throughout the year. Additionally, the CDO and CISO, from time to time, meet with members of management to discuss cybersecurity risks, strategy, and threats.


text: MPC's CISO is responsible for implementing the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Engineering & Operations, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has more than 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing, including collectively serving as a chief information security officer for seven years at two publicly traded companies. Its CISO also holds an Executive Master in Cybersecurity degree, a Master of Computer Science degree, and undergraduate degrees in both computer science and mathematics.


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, its CDO was employed by General Electric Company ("GE") and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. MPC's CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: TransUnion

ticker: TRU


text: Our Information Security program is guided by the ISO/IEC 27001:2022 principles and led by a global-level Information Security Department that develops our security policies, standards and procedures. We seek to evolve our approach to protect against increasing and changing security threats around the world.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which reports to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), provides oversight of mitigation of key risks related to technology and information security. This oversight includes monitoring and approving relevant policies, projects, and programs for the enterprise risk assessments related to technology and information security. The STRC also serves as an escalation point to the ERMC with respect to technology and information security risks. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.


text: The ERMC, which meets monthly, also monitors TransUnion's risk and governance policies and procedures to ensure that TransUnion risks are within the Board-approved Global Risk Taxonomy, which is described below. The ERMC reviews the broader risk environment and provides direction to mitigate (to an acceptable level) identified risks that may adversely affect our ability to achieve strategic objectives. The ERMC stewards our Enterprise Risk Management Policy and additional enterprise policies in risk-related areas, such as privacy and information security and key issues are reported to the appropriate committee of the Board.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Risk and Compliance Committee of the Board. The Risk and Compliance Committee oversees the quality and effectiveness of our information security framework, including capabilities, policies and controls, and methods for identifying, assessing and mitigating information and cybersecurity risks. The Risk and Compliance Committee also assesses the effectiveness of the Company's management of information security-related risks, including consulting with internal and external advisors as appropriate.


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.


text: Our CISO supervises and assists the ERMC in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our CISO, along with the STRC, are responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.


text: Our Information Security program is led by a global-level Information Security Department that develops our security policies, standards and procedures guided by the ISO/IEC 27001:2022 principles and aligned to the Center for Internet Security controls. We seek to evolve our approach to protect against increasing and changing security threats around the world.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India and Asia Pacific who receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center for responding to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.


text: We have not identified incidents from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which escalates significant issues to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), is responsible for overseeing key risks related to technology and information security for the global enterprise. The STRC provides oversight to ensure key risks related to technology and information security have appropriate controls and mitigations in place. The STRC also oversees associated policies, projects and programs for enterprise risk assessments related to technology and information security. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, our cyber risk management program activities and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: monitoring and mitigating cybersecurity threats and risks with a defense structure to provide a third-party cybersecurity oversight program to effectively discover, analyze and understand oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets and information; and an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023, and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.


text: cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.


text: use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.


text: to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework. The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.


text: Role of Management management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.


text: framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board of Directors. audit over cybersecurity related activities is completed by an independent third party.


text: We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: To address risks from cybersecurity threats, we have implemented and maintain cybersecurity policies and procedures, including an incident response plan, and our managed services provider implements a number of cybersecurity technologies and controls, including but not limited to, vulnerability scans and patch management tools. Our current approach to managing cybersecurity risks is informed by periodic risk assessments conducted by our managed services provider that incorporates elements of a recognized industry framework and evaluates our cyber risk management controls. We have implemented a process for senior management to review assessments performed and determine the appropriate treatment of identified risks.


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information about the cybersecurity risks we face, see Item 1A "Risk Factors."


text: We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board was recently tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving reports from members of senior management, including the risk manager and CEO, on areas of identified material risk to the Company.


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data; actively monitoring and mitigating cybersecurity threats and risks with a defense structure to provide oversight, governance, challenge, and testing;


text: using a third-party cybersecurity oversight program maintaining oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023 and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.


text: We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines.


text: We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information.


text: Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.