text: Cybersecurity threats pose a risk to the Company, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into the Company's internal systems or the systems of the Company's third-party vendors could adversely impact the Company's operations or damage its reputation. The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable, and resilient technology infrastructure, fostering a culture of technology risk awareness, and continuously improving its technology risk management practices. The Company's process for monitoring and mitigating cybersecurity risk is designed in conjunction with its overall Enterprise Risk Management Policy. The Company's Information Security Program follows ISO 27002, an international standard for information security controls, as well as references to the Federal Financial Institutions Examination Council Information Examination Handbook, and other regulatory guidance and industry standards.


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks with the Chief Risk Officer ("CRO") where applicable. Together, the CISO and the CRO report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The CISO has over 30 years of information security experience, with experienced team members that come from a wide range of industries and possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting the CISO maintain education and certification requirements necessary to fulfill their responsibilities.

companyName: INDEPENDENT BANK CORP

ticker: INDB

secItem: Item 1C


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents address the detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees and depending on incident severity, the Board, or a Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third-Party Risk Management Program ("TPRM") is involved with onboarding all vendors, including ongoing monitoring of higher risk vendor relationships. TPRM documents the Company's view of applicable third-party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.


text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company conducts regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: While the Company has seen attempts to gain access to its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2024. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third-party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Part I. Item 1A of this Report.


text: Risk Management and Strategy Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE CO


text: Cybersecurity risk management is integrated within our risk management framework. See Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: In order to respond to the threat of security breaches and cyber-attacks, Prudential Financial has developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third-parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader security community and monitor cyber threat information.


text: To address risks associated with third-parties, Prudential Financial has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Prudential Financial's Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.


text: Risk Management and Strategy Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of such risks.


text: Cybersecurity risk management is integrated within our risk management framework. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader cybersecurity community and monitor cyber threat information.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Cyber Risk Management and Strategy In our increasingly interconnected environment, information is inherently exposed to a growing number of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data from the ever-evolving cyber threat environment.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Jack Henry's information and cybersecurity program is a key component of our overall enterprise risk management and is maintained by a team of diverse, highly skilled cybersecurity professionals, as well as a portfolio of investments in modern technology, including artificial intelligence and machine learning. The program safeguards Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through use of comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. Our cybersecurity program includes continuous enterprise monitoring with well-defined and rehearsed business resilience and incident response procedures. Further, we use third-party vendors and consultants to assist in identifying and assessing cybersecurity risks.


text: Jack Henry systems and services undergo regular reviews performed by the same regulatory agencies that review financial institutions: Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. Reviews such as those by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) assess and identify security gaps or flaws in controls. Critical services provided to our clients are subject to annual System and Organization Controls ("SOC") reviews by independent auditors.


text: Our associates and contractors play a vital role in the safeguarding of systems and data. Associates and contractors complete mandatory annual security awareness training to ensure they stay abreast of the latest best practices and related cyber threats. Additionally, we conduct routine phishing exercises to help associates and contractors identify and responsibly respond to suspicious emails. Throughout the year, we target supplemental training and education to higher-risk individuals and teams.


text: Jack Henry relies on third-party service providers to deliver services and products to our clients, and we evaluate and attempt to mitigate the cybersecurity risks associated with the use of these third-party service providers. We conduct evaluations and risk assessments of third-party service providers prior to engagement and on an ongoing periodic basis to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.


text: In fiscal year 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition.


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us and our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot ensure that we will not experience material cybersecurity incidents in the future or that we have not experienced an undetected incident. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: Cyber Security Governance and Oversight Our Board of Directors maintains ultimate oversight over risk functions but has delegated certain oversight responsibilities for enterprise and operational risks, including cybersecurity risk, to the Board's Risk and Compliance Committee. The Risk and Compliance Committee's obligations include overseeing Jack Henry's risk assessment and management programs and reviewing risk preparedness. Our Audit Committee oversees financial risks and would also be informed of a material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports to the Risk and Compliance Committee and to the full Board of Directors on a quarterly basis on information security matters. Additionally, the CISO meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight for cybersecurity risks, management is primarily responsible for identifying, assessing, and managing material cybersecurity risks within our broader risk management program. Management has established the Enterprise Risk Management Committee, headed by Company executives, to monitor the governance, risk, and compliance environment for Jack Henry, which includes review of cybersecurity risk. Management has also adopted specific policies and processes to monitor cybersecurity threats and to mitigate such threats as they arise. These policies and procedures include, among other things, an incident response program, which includes professionals with diverse backgrounds and skillsets, led by our CISO. Our incident response team is designed to monitor and assess cyber and information security related incidents. Any cybersecurity incidents that meet or exceed preestablished thresholds are escalated to management to establish the scope of the threat, apply mitigation and remediation efforts, and assess the need for disclosure to clients, third-party service providers, and regulators.


text: Our CISO, who reports directly to the Chief Risk Officer, has primary responsibility over Jack Henry's overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO has more than 20 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions. The information security team, under the direction of the CISO, regularly monitors general cybersecurity trends and institutes preventative efforts and defensive measures to protect against cybersecurity threats.


text: Cyber Risk Management and Strategy In today's interconnected environment, information is inherently exposed to a wide range of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data in an ever-evolving cyber threat landscape.


text: Jack Henry's information and cybersecurity program is a core component of our overall enterprise risk management framework. It is maintained by a team of highly skilled cybersecurity professionals and supported by investments in modern technology, including artificial intelligence and machine learning. The program is designed to safeguard Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. It includes continuous enterprise monitoring and well-defined and regularly tested business resilience and incident response procedures. We also engage third-party vendors and consultants to assist in identifying, assessing, and mitigating cybersecurity risks.


text: Jack Henry systems and services are subject to regular reviews by the same regulatory agencies that oversee financial institutions, including the Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. These reviews, including those conducted by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) help identify potential security gaps or control deficiencies. In addition, critical services provided to our clients undergo annual System and Organization Controls ("SOC") reviews by independent auditors.


text: Our associates and contractors play a vital role in the safeguarding of systems and data. All are required to complete annual security awareness training to ensure they stay current on best practices and emerging cyber threats. We also conduct routine phishing exercises to help associates and contractors recognize and appropriately respond to suspicious emails. Supplemental training is provided throughout the year to individuals and teams with elevated-risk profiles.


text: Jack Henry relies on third-party service providers to deliver certain services and products to our clients. We evaluate and seek to mitigate the cybersecurity risks associated with these providers through pre-engagement and periodic risk assessments to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.


text: In fiscal year 2025, we did not identify any cybersecurity threats, including those arising from prior incidents, that materially affected our business strategy, results of operations, or financial condition.


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot guarantee that we will not experience a material cybersecurity incident in the future or that an undetected incident has not already occurred. For further discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: CyberSecurity Governance and Oversight Our Board of Directors has ultimate oversight of risk management and has delegated responsibility for enterprise and operational risks, including cybersecurity, to the Board's Risk and Compliance Committee. This Committee oversees Jack Henry's risk assessment and management programs and reviews risk preparedness. The Audit Committee oversees financial risks and would be informed of any material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports quarterly to the Risk and Compliance Committee and to the full Board of Directors on information security matters. The CISO also meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight of cybersecurity risks, management is primarily responsible for identifying, assessing, and managing these risks within our broader risk management program. The Enterprise Risk Management Committee, composed of senior executives, monitors governance, risk, and compliance enterprise-wide, including cybersecurity. Management has adopted specific policies and procedures to monitor and mitigate cybersecurity threats including an incident response program, led by the CISO and staffed by professionals with diverse expertise. Incidents meeting pre-established thresholds are escalated to management for threat assessment, mitigation, remediation, and, if necessary, disclosure to clients, third-parties, and regulators.


text: Our CISO, who reports to the Chief Operations Officer, has primary responsibility for Jack Henry's information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO brings more than 20 years experience in technology and cybersecurity, including senior leadership roles at major financial institutions. Under the CISO's direction, the information security team continuously monitors cybersecurity trends and implements proactive and defensive measures to protect against cybersecurity threats.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Management, with the assistance of third party service providers, routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We conduct risk assessments at least annually to identify cybersecurity threats based on the NIST CSF. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: While cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations and could materially adversely affect our business, results of operations and financial condition.


text: Our senior management, including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Co-Chief Operating Officers, are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to provide reasonable assurance that such potential cybersecurity risk exposures are monitored, instituting appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity program is led by our CFO who has experience in cybersecurity risk management from both a practical and management standpoint and utilizes third-party consulting firms on a regular basis to assist with risk mitigation, incident response and overall maintenance of our cybersecurity program.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: The Board of Directors of the Company (the "Board") considers cybersecurity risk as part of its overall risk oversight function. The Board receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Vista's system of internal controls includes consideration of cybersecurity risks. The Company uses technology and control procedures designed to mitigate cybersecurity risks, with our management team working to monitor, identify, assess, and respond to potential cybersecurity incidents that may threaten the Company. The system of controls also focuses on security awareness and training for employees and contractors with access to Company facilities or systems. Company management periodically reviews system and organization control reports (SOC 1, Type 2) for key outsourced information systems to ensure that third-party data processing is subject to appropriate controls and security measures. Cybersecurity risks for Vista include the potential for financial loss, loss of data, and business interruption. Vista maintains technology and non-technology-based system controls, a data backup program, and disaster recovery testing to mitigate these risks.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Our cybersecurity controls also follow defense in depth principles, which aim to implement various layered access control, detection, prevention, and response measures. We periodically engage with third parties to assess our vulnerabilities and help us mitigate cybersecurity-related risks.


text: Management's Role in Assessing and Managing Cybersecurity Risks The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsible for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for IT general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. Per the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.


text: Board of Director's Oversight of Risks from Cybersecurity Management, under supervision of the Company's CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The full Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, provided with the same information presented to the Audit Committee.


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Management's Role in Assessing and Managing Cybersecurity Risks The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsibility for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for information technology ("IT") general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. In accordance with the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.


text: Board of Directors' Oversight of Risks from Cybersecurity Management, under supervision of the CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, is provided with the same information presented to the Audit Committee.


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have established cybersecurity measures, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: ARTIVION, INC.

ticker: AORT


text: Our enterprise risk management framework assesses cybersecurity threats alongside other company risks as part of our overall risk assessment process. This approach involves collaboration between enterprise risk professionals and subject matter experts to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We leverage various tools and services, including network monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to enhance our risk identification and assessment capabilities.


text: Our cybersecurity-specific risk assessment process, benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes expert-led penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To safeguard critical data and systems, ensure regulatory compliance, manage our material risks from cybersecurity threats, and address potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Provide periodic, but no less than, annual training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing to enhance staff awareness and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Contract with independent cybersecurity providers to assist with tabletop exercises periodically to refine our response strategies to cybersecurity incidents; • Employ the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.


text: Our incident response plan outlines our approach to preparing for, detecting, responding to, and recovering from cybersecurity incidents, including severity assessment, containment, investigation, and remediation processes.


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and ensure compliance, as well as assessments and audits by our insurer and our external auditing firm.


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct thorough due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.


text: The potential impact of cybersecurity threats on our business strategy, operations, and financial condition is discussed under specific headings in our risk factor disclosures at Item 1A and in the Management's Discussion and Analysis of Financial Condition and Results of Operations at Item 7 of this Annual Report on Form 10-K.


text: We are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.


text: Cybersecurity is integral to our overall risk management strategy, and an area of increasing focus for our Board and management. The Audit Committee, and where applicable, the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, from management on our cybersecurity threat risk management and strategy processes. These updates cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and material cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.


text: Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer. Our information technology and cybersecurity team has over 33 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members hold numerous degrees and certifications, including certifications as a Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.


text: The global head of Information Technology is part of our operating team and ensures that management is well-informed about preventing, mitigating, detecting, and remediating cybersecurity incidents. This role involves managing our comprehensive cybersecurity risk management and strategy processes and overseeing the operation of our incident response plan.


text: In conclusion, our global head of Information Technology regularly updates the Audit Committee and the Board of Directors on cybersecurity threat risks and related matters, ensuring a proactive and informed approach to managing cybersecurity within our organization.


text: Our cybersecurity-specific risk assessment process benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To safeguard critical data and systems, support regulatory compliance, manage our material risks from cybersecurity threats, and identify, assess and respond to potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Utilize Endpoint Detection and Response (EDR) tools to help us prevent, detect, and respond to endpoint threats with real-time visibility across our infrastructure and devices, enterprise-wide; • Provide periodic, but no less than annual, training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing events and concerns to enhance staff awareness, vigilance, and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Employ elements of the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and support compliance, as well as assessments and audits by our insurer and our external auditing firm.


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.


text: Our information systems have been subject to cybersecurity incidents in the past, including a cyber-attack identified and disclosed during the fourth quarter of 2024 (the "Cybersecurity Incident") that temporarily disrupted our business operations, including our ERP systems, and had an impact on manufacturing, order processing, shipping, and other corporate operations. Although we are continuing to work with our insurer to recoup covered losses, we do expect to continue to incur expenses in connection with improving our global cybersecurity infrastructure and cybersecurity posture.


text: As of the date of this Annual Report on Form 10-K, we believe that the Cybersecurity Incident has not materially impacted the Company, our overall financial condition or results of operations, and that the incident is not reasonably likely to materially impact the Company, our financial conditions or results of operations. In addition, we are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition as of the date of this Annual Report on Form 10-K. This includes penalties and settlements, of which there were none. We are seeking reimbursement of costs, expenses and losses stemming from the Cybersecurity Incident by submitting claims to our cybersecurity insurer. The timing and amount of any such reimbursements are not known at this time. As discussed in more detail in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations", the Cybersecurity Incident had a $4.6 million impact on our results for the year ended December 31, 2024.


text: To learn more about the risk and potential impact of cybersecurity threats on our business strategy, operations, and financial condition, including with respect to the Cybersecurity Incident, See Part I, Item 1A, "Risk Factors," "Significant disruptions of information technology systems or breaches of information security systems could adversely affect our business".


text: Cybersecurity is integrated with our overall risk management strategy and is an area of focus for our Board and management, with oversight at the executive level led by our Chief Financial Officer. The Audit Committee, and where applicable, other directors or the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, on our cybersecurity threat risk management and strategy processes, and may meet more frequently in response to specific threats or incidents. These updates, provided by our Chief Financial Officer and/or our global head of Information Technology, cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and select cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.


text: Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer and focus on preventing, mitigating, detecting and remediating cybersecurity incidents, as well as threat risks and related matters. The global head of Information Technology is part of our operating team and is responsible for implementing our cybersecurity risk management and strategy processes and the operation of our incident response and business continuity plan. Management uses information provided by our global head of Information Technology, along with feedback from external experts, the Audit Committee, and our Board, as part of the cyber-specific and enterprise-wide risk management process described above.


text: Our information technology and cybersecurity team has approximately 35 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members' relevant degrees and certifications include but are not limited to Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.


text: PGE considers cybersecurity to be a top enterprise risk and manages the risk by following established practices for assessment, protection, response, and oversight. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk. All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.


text: PGE has a threat intelligence function to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and periodic exercises.


text: PGE engages a third party to attempt to penetrate its systems periodically. The Company also uses a separate third party to conduct an assessment of its cybersecurity program maturity. These assessments allow PGE to upgrade processes and mitigate gaps regularly, rather than having a static program. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet our security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. PGE also has procured cybersecurity insurance.


text: Cybersecurity is a top enterprise risk in PGE's enterprise risk management program. An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors. PGE has a management-level committee, the Integrated Security Executive Committee (ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.


text: The Audit and Risk Committee of the Board of Directors has oversight of cybersecurity risk and receives briefings on a quarterly basis. The briefings are provided either by the cybersecurity team, together with a senior member of management, or are presented as part of the Audit and Risk Committee's regular review of top enterprise risks, in which cybersecurity risk is reviewed annually or more frequently if circumstances warrant. The Audit and Risk Committee briefs the full Board of Directors at each meeting. In addition, the full Board of Directors has participated in cybersecurity exercises. The Audit and Risk Committee is also provided with information about external assessment results and action plans. There is a process in place to notify the Audit and Risk Committee promptly in the event of a material cybersecurity incident.


text: PGE considers cybersecurity to be a top enterprise risk in PGE's enterprise risk management program, and manages the risk by adhering to established security policies and governance, identifying risk through risk assessments, utilizing technology to provide a layered security approach, controlling access, robust security awareness training and conducting resiliency exercises. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk.


text: An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors.


text: PGE has a management-level committee, the Integrated Security Executive Committee ( ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.


text: PGE has a threat intelligence and insider risk program to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and assessments. In addition, cyber security resiliency is enhanced through regular functional and tabletop exercises.


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet the Company's security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. The Company also has procured cybersecurity insurance.


text: All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.


text: PGE engages a third party to attempt to penetrate its systems periodically. These assessments support a continuous improvement initiative, ensuring ongoing enhancements to security posture. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.


text: Process for Assessing, Identifying and Managing Material Cybersecurity Risks The proper function, availability, and security of our and third-party information systems are critical to our business. We have attempted to structure our cybersecurity program and its incident response policies and procedures, including an incident response plan (the "IRP"), around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides best practices to identify, protect from, respond to, and recover from cyber attacks. The cybersecurity program, led by our chief security officer ("CSO"), consists of dedicated internal IT security employees, including the staff of a security operations center, and long-term third-party security service providers. Our IT security staff, led by our CSO, is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. In furtherance of our cybersecurity program, members of our internal security staff participate in industry and governmental cybersecurity cooperative groups, including the Health Information Sharing and Analysis Center ("H-ISAC") and the FBI's InfraGard.

companyName: Encompass Health Corp

ticker: EHC


text: Our CSO, who assumed his current role in 2022, has over 10 years of cybersecurity experience with us and over 27 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 34 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.


text: We maintain an inter-departmental privacy and security committee that oversees our programs and initiatives that seek to protect and secure patient information as well as our data and information systems. This committee is responsible for, among other things, administering our incident response policies and procedures and various training and awareness programs that promote good system security practices by employees. This committee consists of our CSO, CIO, deputy CIO, chief privacy officer, and director of information security and compliance as well as in house attorneys responsible for cybersecurity and securities matters. It currently meets monthly and as warranted by privacy and security events.


text: The IRP sets forth the strategy to prepare for cybersecurity threats and incidents and the processes and procedures to detect, analyze, contain, and recover after any actual or suspected cybersecurity incidents. The IRP also sets forth the internal reporting process for cybersecurity incidents. In the event of the detection of an actual or suspected cybersecurity incident, the IRP provides that our IT security staff score the incident based on established criteria and manage the incident pursuant to the standard operating procedures. Depending on the assessed criticality of the incident and the systems affected, the staff will report an incident to a security triage team, consisting of the security operations incident response lead and several members of the privacy and security committee. Working with our third-party security vendors as needed, the triage team investigates the incident, manages the response, and reports threats and incidents deemed significant to securities counsel. Securities counsel then works with the executive team to assess materiality for the Company. A member of the executive team would inform our board of directors as warranted.


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.


text: Third-party IT Vendor Risk Management Our IT security staff also maintains a third-party IT vendor risk management process. The staff identifies the third parties with whom we contract or otherwise have a relationship involving our network or digital assets that represent an elevated risk based on a detailed rating process. The IT vendor risk management process involves input from various departments, including the affected internal business constituencies, legal, and compliance.


text: Using a platform endorsed by the H-ISAC, the IT security staff performs risk assessments of third parties that appear to represent the greatest risk to our systems and data. Annually, the privacy and security committee reviews and approves our listing of tier one vendors subject to the assessment. The IT security staff then works with the internal points of contact responsible for the applications, software or systems and the vendors to gather the information necessary to assess the associated risks using common cybersecurity standards and frameworks. Any significant risks identified are shared with the vendors and the compensating controls for those risks are documented in collaboration with the vendors. The internal points of contact and other constituencies then review the results of the assessment process in order to assess the associated value of the product or service against the risk.


text: Integration into the Overall Risk Management System Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (the "ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates to assess the most significant risks to the Company as a whole. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. Management presents quarterly the ERM risk assessment, including key risk indicators, to our board of directors.


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience in cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our annual tabletop incident response exercise.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident. As of February 28, 2024, we have not identified any compromise or unauthorized access of our systems or networks. The Change Healthcare incident has not affected our operations, except the submission of payment claims. At this time, we have not determined that this disruption to our submission of claims is likely to materially affect our business strategy, results of operation or financial condition.


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation.


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."


text: Our CSO, who assumed his current role in 2022, has over 11 years of cybersecurity experience with us and over 28 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 35 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Given the extensive practical experience of implementing our IRP and business continuity plan during the Change Healthcare incident, discussed further below, we did not conduct a separate mock tabletop exercise in 2024. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain ongoing engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience to support cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our tabletop incident response exercises.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acted as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident and did not identify any compromise or unauthorized access of our systems or networks. However, the incident did affect our ability to submit any claims for payment for a period of time until we implemented alternative modes for submissions. We have not identified any compromise or unauthorized access of our systems or networks, and the temporary disruption to our submission of claims did not materially affect our business strategy, results of operation or financial condition.


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business vendors and partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."


text: Risk Management and Strategy As a leading provider of technology-enabled healthcare and public health services, medical logistics, and readiness enhancement services, we continuously monitor for and defend against cyber threats and advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents As a public company and a government contractor, we are required to comply with extensive security and compliance regulations and standards and we employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity risk management program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and comply with extensive regulations, including U.S. government cybersecurity regulations. Our policies and implemented controls are assessed at least annually by external organizations for compliance with Federal Risk and Authorization Management ("FedRAMP"), Federal Information Security Modernization Act ("FISMA"), Cybersecurity Maturity Model Certification ("CMMC"), and International Organization for Standardization ("ISO") 27001 standards. We also conduct periodic penetration tests, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, as well as our ability to respond to and recover from cybersecurity incidents. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises, including through employee cybersecurity training and ongoing investments in capabilities to protect our assets.

companyName: DLH Holdings Corp.

ticker: DLHC


text: Governance and Management's Responsibilities Our cybersecurity risk management program is led by Executive and Senior management, who hold a number of certifications including Certified CMMC Professional ("CCP"), Certified Information Security Manager ("CISM"), and Project Management Professional ("PMP"). Management is responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. The team of senior management officers responsible for our cybersecurity function is tasked with ensuring that potential cybersecurity risks are monitored, appropriate mitigation measures are implemented, and our processes for identifying and assessing cybersecurity risks and reporting cybersecurity breaches and other information security incidents operate as designed and comply with applicable requirements.


text: Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks. Our Cybersecurity, Technology, and Biomedical Research ("CTBR") Committee is chaired by an independent director who is certified in Cybersecurity Oversight. The CTBR Committee receives briefings on our cybersecurity posture and cybersecurity trends and risks from management. Our CTBR Committee regularly briefs our Board of Directors on security posture, planned activities, and cybersecurity risks which may cause a material, adverse impact to the Company's operations, reputation, or value and will report any findings or make recommendations to the Board, as appropriate.


text: Cybersecurity Threats To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of AES' cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including DPL and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.

companyName: DAYTON POWER & LIGHT CO


text: DPL Inc. and AES Ohio The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of DPL and its subsidiaries to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and PUCO regulation.


text: Our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.


text: In addition, our management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. Our CEO, CFO and other members of senior management participate in such meetings.


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and our Board. We regularly practice our incident response through executive tabletop exercises.


text: DPL Inc. and AES Ohio We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: We recognize the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: MGM Resorts International

ticker: MGM


text: Risk Management and Strategy The Company's Internal Audit function conducts an annual Enterprise Risk Management process to identify, assess, monitor and control current and future potential risks facing the Company, which includes cybersecurity risks that are communicated by the Chief Information Security Officer ("CISO"). Significant risks identified during this process are then presented to the Audit Committee. In addition, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. We also routinely perform attack and response simulations at the technical level, and annually execute tabletop response exercises. Each year, special focus is given to maintaining and improving our alignment with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Privacy and Payment Card Industry ("PCI") controls in support of protecting our technology and customer data. We further engage in the periodic assessment and testing of our cybersecurity program.


text: We also utilize external expertise to perform annual assessments of our entire cybersecurity program, including the cybersecurity program maturity. The results of these annual assessments are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, we have a Third Party Risk Management Program designed to assess risks associated with third party providers based on the services they provide and the data they have access to.


text: Cybersecurity risk mitigation processes are integrated into the Company's Code of Conduct that all employees are required to review. Additionally, all employees with network access receive cybersecurity awareness training.


text: The Company's information and data systems have been subject to cybersecurity incidents in the past, including the publicly disclosed September 2023 Cybersecurity Issue. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, there is no guaranty that the Cybersecurity Issue and any further incidents will not have a material impact in the future. See "Cybersecurity litigation, claims, and investigations" in Part II, Item 8, Note 12 to the accompanying consolidated financial statements. Further, policies and procedures designed to manage cyber risks, including those described herein, may not be effective. To learn more about risks from cybersecurity threats, see "Item 1A. Risk Factors - The failure to maintain the integrity of our information and other systems or customer information can result in damage to our reputation, subject us to fines, payment of damages, lawsuits and restrictions on our use of data, and have a material adverse effect on our business, financial condition, and results of operations." Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect the Company's business, financial condition, or results of operations.


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives quarterly reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has 23 years of expertise in cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information technology and information security throughout their career. The CISO holds various professional certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association and the Certified Information Systems Security Professional from International Information System Security Certification Consortium. The CISO holds a Bachelor's Degree in Computer Information Systems and a Master's Degree in Organizational Security Management.