text: Management and Board Oversight Our Chief Financial Officer ("CFO") has significant work experience related to information security issues and oversight and is the executive officer that oversees our cybersecurity program, which includes the implementation of controls to identify threats, detect attacks and protect our information assets. Our dedicated ERM Committee, which includes our CFO and certain members of our executive leadership team, provides principal oversight and guidance of our cybersecurity risk management programs and processes. While our Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures. The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report cybersecurity incidents to the Audit Committee as they occur, if material.


text: Cybersecurity Risks In addition to the reliance on our own information technology systems, we rely on the information technology systems of our hotel managers to protect proprietary and customer information as well as our third-party service providers who support key portions of our operations. Any compromises of our own network or the networks of our hotel managers or third-party service providers could materially affect our business, financial condition and results of operations. For a discussion of our cybersecurity risks, refer to "Part I - Item 1A. Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our hotel managers' or our own information technology and systems, including third-party service providers, could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K. Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us. We carry insurance that helps provide protection against the potential losses arising from cybersecurity incidents, although we may incur expenses and losses related to a cybersecurity incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: Park Hotels & Resorts Inc.

ticker: PK

secItem: Item 1C


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks that could materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.


text: Risk Management, Strategy and Management Oversight We have an enterprise risk management function at Zillow Group responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior, cross-functional business leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, communications, and business products, among others. In partnership with risk owners, this steering committee monitors risk exposures and verifies that efficient and effective risk-management strategies or acceptance and notification criteria are in place. The steering committee meets at least quarterly and its activities are overseen by the Audit Committee of our Board of Directors ("Board").


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and prevent cybersecurity incidents. The information security team is led by our Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in the financial services, technology and casino industries and is a certified information systems security professional.


text: The information security team maintains incident response policies and procedures designed to help protect the integrity, availability and confidentiality of information and help prevent loss of service. Cybersecurity events and incidents may be reported or detected through a variety of means, including emails to centralized information security addresses, our online information technology ticketing system, automatic alerts and incident detection systems, direct discovery by our information security team, or reports from a third party. Additionally, our incident response policies and procedures specify the process for initial investigation and containment procedures, remediation tactics, retention of documentation and internal and external communications. Our incident response policies and procedures also specify processes for analyzing the severity of an identified incident, which serve to dictate the escalation procedures to notify varying levels of our risk management team. In response to cybersecurity incidents, we may involve external advisors to assist with remediation efforts and communications and we may seek to mitigate associated liabilities through our insurance coverage. Such third parties may include external legal counsel, forensic investigators and public relation firms, among others. These vendors serve to support our existing processes and procedures and operate as an extension of our enterprise risk management and information security functions.


text: Our internal audit team conducts security controls testing and provides independent validation that such controls are operating effectively on systems in scope for various regulatory and compliance requirements. Our regulatory compliance team uses third-party external auditors to perform independent testing against all systems in scope for our regulatory and customer- driven compliance obligations. The audit cadence aligns with regulatory and customer-driven needs. The scope of our audits includes all systems that store, transmit or process data. We also perform periodic third-party risk assessments, vulnerability testing, system and cloud security assessments against our information technology systems.


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology. We have a third-party service provider management program to manage cybersecurity risks associated with our use of these third-party service providers. The program includes the use of security questionnaires, review of statements of work and related information security addenda, procuring results of audits and compliance reviews and obtaining overviews of network infrastructure, among others. Based upon the extent and type of services utilized, reviews of certain third-party engagements are coordinated through members of the following management teams: procurement, legal, compliance, enterprise risk management and information security risk management, among others, as applicable. Depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the third-party, our third-party service provider management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our Board considers risk assessment and development of risk mitigation strategies to be a responsibility of the entire Board in consultation with the appropriate Board committees. The Board regularly engages in risk oversight on a broad range of matters, including challenges associated with strategic acquisitions, cybersecurity, regulatory and other legal and compliance matters. For more focused risk oversight, our Board committees are tasked with specific risk management roles.


text: The Audit Committee oversees major enterprise risks and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. Members of our legal, compliance, enterprise risk management and information security management teams provide information and updates on any significant issues related to these topics at the periodic Audit Committee meetings, which are typically held at least quarterly. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by internal audit and third party consultants, among others.


text: Audit Committee member education is provided throughout the year through presentations to and discussions with the Audit Committee led by members of management, third-party consultants, our independent registered public accounting firm and legal counsel, on topics including information security, among others. Members of our Audit Committee have expertise in the technology industry as well as corporate risk management strategies.


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information and continually align our cybersecurity program with our overall business strategy.


text: As of the date of this Annual Report on Form 10-K, we have not identified material risks from known cybersecurity threats that have materially affected Zillow Group. Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks inherent to our normal course of operation that, if realized, are reasonably likely to materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.


text: Risk Management, Strategy and Management Oversight We have an enterprise risk management function responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, and business products, among others. In partnership with other stakeholders, this steering committee monitors risk exposures, promotes risk-management strategies, and implements acceptance and notification criteria. The activities of the steering committee are overseen by the Audit Committee of our Board (the "Audit Committee").


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and respond to cybersecurity incidents. The information security team is led by a designated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of technology and cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in heavily regulated industries such as financial services, technology and gaming and is a certified information systems security professional.


text: The information security team maintains incident response policies and procedures designed to help protect the integrity, availability and confidentiality of information and help prevent loss of service. Additionally, we conduct an annual cybersecurity awareness training to educate our employees and empower them to help prevent and respond to cybersecurity events and incidents. Cybersecurity events and incidents may be reported or detected through a variety of means, including emails to centralized information security addresses, our online information technology ticketing system, automatic alerts and incident detection systems, direct discovery by our information security team, or reports from employees or other third parties. Additionally, our incident response policies and procedures specify the process for initial investigation and containment procedures, remediation tactics, retention of documentation and internal and external communications. Our incident response policies and procedures also specify processes for analyzing the severity of an identified incident. In response to cybersecurity incidents, we may involve external advisors to assist with remediation efforts and communications and we may seek to mitigate associated liabilities through our insurance coverage. Such third parties may include external legal counsel, forensic investigators and public relation firms, among others. These vendors serve to support our existing processes and procedures and operate as an extension of our enterprise risk management and information security functions.


text: Our internal audit team conducts security controls testing over systems in scope for various regulatory and compliance requirements. In addition, management performs periodic third-party risk assessments, vulnerability testing, system and cloud security assessments against our information technology environment. Management also engages third-party external auditors to perform independent testing against all systems in scope for our regulatory and customer-driven compliance obligations.


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology. We rely on these third parties to implement their own cybersecurity programs and cannot ensure their effectiveness. To manage cybersecurity risks arising from our use of third parties, we have a third-party service provider management program which includes the use of security questionnaires, review of statements of work and related information security addenda, procuring results of audits and compliance reviews and obtaining overviews of network infrastructure, among others. Depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the third-party, our third-party service provider management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: The Audit Committee oversees major enterprise risks and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. Members of our legal, compliance, enterprise risk management and information security management teams provide information and updates on any significant issues related to these topics at Audit Committee meetings, which are typically held at least quarterly. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by internal audit and third party consultants, among others.


text: Audit Committee member education is provided throughout the year through presentations and discussions led by members of management, third-party consultants, our independent registered public accounting firm and legal counsel, on topics including information security, among others. Members of our Audit Committee have expertise in the technology industry as well as corporate risk management strategies.


text: Risk Management and Strategy As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect, and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.

companyName: MOSAIC CO

ticker: MOS


text: Mosaic's cybersecurity program is comprised of people, processes, and technology that are designed to adequately protect the confidentiality, integrity, and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members from our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.


text: Regularly, Mosaic engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness. As part of our third-party risk oversight, we regularly review the vendor's ratings and conduct assessments and interviews with their personnel. The results are then reported to leaders in the Information Technology department.


text: Board of Director Oversight The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed.


text: Management's Role in Managing Risk The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity, and risk management experience in the manufacturing, electric, defense, financial, and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure, and military defense systems.


text: The CIO and CISO regularly update the Board and/or the Audit Committee on cybersecurity matters and the effectiveness of the cybersecurity program. The Board and Audit Committee also engage directly with senior leaders from the Information Technology department.


text: Risk Management and Strategy As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.


text: Mosaic's cybersecurity program is comprised of people, processes and technology that are designed to adequately protect the confidentiality, integrity and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members of our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.


text: Board of Director Oversight The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ( "CISO") and Chief Information Officer ("CIO ") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed.


text: Management's Role in Managing Risk The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure and military defense systems.


text: Risk Management and Strategy We rely upon information technology networks and systems to process, transmit, and store electronic information, and to manage or support virtually all of our business processes and activities. We also use mobile devices, social networking, and other online activities to connect with our employees, suppliers, business partners, and customers. Accordingly, we maintain a comprehensive Information Security Program, anchored in a multi-tiered, defense-in-depth strategy designed to identify and mitigate risks from cybersecurity threats. We believe that our Information Security Program aligns with industry frameworks and assesses security trends, and facilitates identification and reduction of vulnerabilities. Our cybersecurity strategy considers existing risks to our company and those that we are likely to encounter based on our industry, company profile, and business objectives. Consideration of risks from cybersecurity threats is a key component of our overall enterprise risk management strategy.

companyName: Performance Food Group Co

ticker: PFGC


text: We have implemented a risk management program to identify and track information risks, including cybersecurity threats, from many different sources, including third parties, technology projects, acquisitions, risk assessments, technical assessments, and internal/external audits, and assess them based on severity. Our annual information technology general control testing, which is conducted in connection with our internal control over financial reporting review process, and periodic reviews of risks and controls related to cybersecurity threats that may impact financial reporting control objectives also serve to identify and track information risks. Additionally, we partner with independent third-party service providers to regularly perform cybersecurity assessments, such as network and application penetration testing.


text: We maintain a regularly revised Cybersecurity Incident Response Plan and Cybersecurity Incident Notification Policy, which provide protocols for evaluating and responding to cybersecurity incidents, including escalation of information to senior leadership, including the Board of Directors, as appropriate, and meeting external reporting obligations. We periodically perform tabletop exercises where we perform walkthroughs of cybersecurity incident situations to test our response plans. To date, we have not experienced any cybersecurity incidents that materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition, but future incidents cannot be predicted. See "Part 1, Item 1A. Risk Factors" for additional information regarding cybersecurity-related risks that could impact our business.


text: Our Board of Directors executes its cybersecurity risk oversight function as a whole and by delegating responsibility to the Technology and Cybersecurity Committee of our Board of Directors, which oversees our management of risks relating to information technology security and our cybersecurity policies, controls and procedures. The Audit and Finance Committee of our Board of Directors oversees our enterprise risk management program as a whole and risk management regarding major financial risk exposure, including the potential financial impact of cybersecurity incidents. The Technology and Cybersecurity Committee receives quarterly presentations and reports on cybersecurity and information security risks from management, including our Executive Vice President and Chief Information Officer ("CIO") and Vice President, Chief Information Security Officer ("CISO"). These presentations and reports address a broad range of topics, including progress of security initiatives, strategy, key performance indicators, cybersecurity risks, and notable cybersecurity incidents. In addition, the Technology and Cybersecurity Committee and the Board of Directors receive briefings from time to time from outside experts for an independent view on cybersecurity risks and emerging cybersecurity threats, including best practices and current trends in cybersecurity.


text: Our CIO's experience includes over 25 years of experience in information technology leadership roles, including ProBuild Holdings, the nation's largest supplier of building materials; Gates Corporation, a manufacturer/distributor of automotive parts; and Nupremis Inc., a start-up that provided hosting and managed services. We also have a dedicated CISO, whose team is responsible for management of PFG's Information Security Program, policies, compliance with internal/external mandates, strategy, security incident planning and response. Our CISO reports to our CIO and has more than 20 years of cybersecurity, technology assurance and controls experience, including 18 years as a Certified Information Systems Security Professional (CISSP) and 13 years at PFG in information security and compliance. Our CISO joined PFG following several years of experience working in information security consulting, including Big 4 Accounting and Assurance, as well as working in industries including banking and finance.


text: Cybersecurity risk management and strategy We recognize the critical importance of maintaining the trust and confidence of our customers, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are embedded within our overall enterprise risk management ("ERM") program.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our operations utilize multiple information systems, including accounting software, human resources management software, back of house systems, supply chain software, our brands' mobile apps, online ordering platforms, in-restaurant kiosks, point-of-sale software, and back-of-house software. In the ordinary course of our business, we collect, process, transmit, disclose, and retain personal information regarding our employees, our franchisees, vendors, contractors, and guests (which can include social security numbers, social insurance numbers, banking and tax identification information, health care information for employees, and credit card information) and our franchisees collect similar information.


text: To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and include the following components: • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Deployment of Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to cybersecurity threats, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans includes a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip them with effective tools to detect and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our Audit Committee oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Internal Audit function performs periodic audits of our cyber security program and reports results to the Audit Committee. On a periodic basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").


text: Our CISO works in coordination with our senior management and leaders at each of our brands to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CISO and the internal security team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate. We also use a Managed Security Service Provider (MSSP) to provide continuous monitoring of our systems and supplement our internal security team.


text: As of December 31, 2023, our CISO has served in various roles in information technology and information security for over 37 years, as an IT auditor and an IT security executive. He has been in various industries including Finance, Manufacturing and Retail. The CISO has both the CISA and CRP designations.


text: While cybersecurity threats as a result of any previous cybersecurity incidents have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs and/or expose us to litigation.


text: Executive Officers of Restaurant Brands International, Inc., General Partner of Registrant Set forth below is certain information about our executive officers as of February 20, 2024. President, Tim Hortons Canada & U.S.


text: Controller and Chief Accounting Officer Patrick Doyle. Mr. Doyle has served as Executive Chair of our Board since January 2023 and was appointed Executive Chairman of RBI in November 2022. Most recently, he served as an executive partner focused on the consumer sector of the Carlyle Group, a global diversified investment firm from September 2019 through November 2022, Prior to that he served as the chief executive officer of Domino's Pizza from March 2010 to June 2018, having served as president from 2007 to 2010, as executive vice president of Domino's Team USA from 2004 to 2007 and as executive vice president of Domino's International form 1999 to 2004.


text: Joshua Kobza. Mr. Kobza was appointed Chief Executive Officer of RBI effective March 1, 2023. Prior to that, Mr. Kobza served as Chief Operating Officer of RBI from January 2019 to March 2023, as Chief Technology and Development Officer of RBI from January 2018 to January 2019, and as Chief Financial Officer of RBI from December 2014 to January 2018. From April 2013 to December 2014, Mr. Kobza served as Executive Vice President and Chief Financial Officer of Burger King Worldwide. Mr. Kobza joined Burger King Worldwide in June 2012 as Director, Investor Relations, and was promoted to Senior Vice President, Global Finance in December 2012.


text: Matthew Dunnigan. Mr. Dunnigan was appointed Chief Financial Officer of RBI in January 2018. From October 2014 until January 2018, Mr. Dunnigan held the position of Treasurer, where he took on increasing responsibilities and successfully led all of RBI's capital markets activities. Before he joined RBI, Mr. Dunnigan served as Vice President of Crescent Capital Group LP, from September 2013 through October 2014, where he evaluated investments across the credit markets. Prior to that, Mr. Dunnigan was a private equity investment professional for H.I.G. Capital.


text: Axel Schwan. Mr. Schwan was appointed as President, Tim Hortons Canada & US in October 2019 after serving as Global Chief Marketing Officer for Tim Hortons since October 2017. Mr. Schwan first joined RBI as Marketing Director, Germany, Austria and Switzerland in 2011 and was then appointed as Vice President, Marketing and Communications, EMEA for Burger King before advancing to the role of Global Chief Marketing Officer for the brand in January 2014. Prior to joining RBI, Mr. Schwan led the Schwan family restaurant business, alongside his sister, and worked in various marketing roles at Unilever and Danone in Germany.


text: Tom Curtis. Mr. Curtis was appointed President, Burger King U.S. & Canada in October 2021. From May 2021 to October 2021, he was the Chief Operating Officer, where he was responsible for overseeing field operations, restaurant development and restaurant operations. Prior to joining BKC, Mr. Curtis spent 35-years at Domino's Pizza, Inc., where he most recently served as Executive Vice President, U.S. Operations and Global Operations Support, overseeing both franchise and company-owned operations from March 2020 to April 2021. Prior to that, he served as Executive Vice President, Corporate Operations from July 2018 to March 2020, and as Vice President of Franchise Relations and Operations Innovation from March 2017 to July 2018. Mr. Curtis joined Domino's in 2006, after being a Domino's franchisee since 1987.


text: Sami Siddiqui. Mr. Siddiqui was appointed President, Popeyes U.S. & Canada in September 2020. Prior to that Mr. Siddiqui served as President of Asia Pacific for RBI from February 2019 to September 2020 and as Chief Financial Officer for Burger King Corporation from October 2018 to February 2019. From September 2016 to September 2018, he was President of Tim Hortons and from April 2015 to September 2016, he was Executive Vice President, Finance for Tim Hortons. Mr. Siddiqui joined Burger King Corporation in 2013 and served various capacities within the Global Finance groups of Burger King Corporation prior to joining the Tim Hortons team.


text: David Shear. Mr. Shear was appointed President International of RBI in January 2021. Mr. Shear previously served as President EMEA beginning in September 2016. Mr. Shear joined the predecessor of RBI in 2011, holding roles of increasing responsibility within Burger King U.S. marketing. He then held various roles in Asia Pacific, including serving as President of Burger King APAC from 2014 to 2016. Prior to joining Burger King, Mr. Shear worked at strategy consulting firm Charles River Associates.


text: Duncan Fulton. Mr. Fulton was appointed Chief Corporate Officer of RBI, in June 2018, overseeing global communications, North American franchising, government relations and ESG initiatives. Mr. Fulton also serves as Chairman of the Board of Directors for the Tim Hortons Foundation. Prior to joining RBI, Mr. Fulton held several positions with Canadian Tire Corporation (CTC) from November 2009 to March 2018, including Senior Vice President of Corporate Affairs, Chief Marketing Officer for FGL Sports and Mark's Work Warehouse, and President of FGL Sports. Previously, Mr. Fulton was Senior Partner and General Manager of Fleishman-Hilliard from April 2002 to November 2009. Prior to his agency experience, Mr. Fulton served as a communication advisor and spokesman for several political leaders, including former Canadian Prime Minister Jean Chr tien, Ontario Premier Dalton McGuinty and New Brunswick Premier Frank McKenna.


text: Jeff Housman. Mr. Housman was appointed Chief People & Services Officer of RBI in April 2021 and previously served as Chief Human Resources Officer beginning in February 2017 as well as Head of Global Business Services from January 2015 to January 2017. Mr. Housman joined Burger King in April 2013 serving in finance, real estate and business services roles. Prior to joining Burger King, Mr. Housman worked in investment banking at J.P. Morgan, and he holds an MBA from Columbia Business School and a Bachelor's in Business Administration from Emory University.


text: Jill Granat. Ms. Granat was appointed General Counsel and Corporate Secretary of RBI in December 2014. Ms. Granat served as Senior Vice President, General Counsel and Secretary of Burger King Worldwide and its predecessor since February 2011. Prior to this time, Ms. Granat was Vice President and Assistant General Counsel of Burger King Corporation from July 2009 until February 2011. Ms. Granat joined Burger King Corporation in 1998 as a member of the legal department and served in positions of increasing responsibility with Burger King Corporation.


text: Jacqueline Friesner. Ms. Friesner was appointed Controller and Chief Accounting Officer of RBI in December 2014. Ms. Friesner served as Vice President, Controller and Chief Accounting Officer of Burger King Worldwide and its predecessor from March 2011 until December 2014. Prior thereto, Ms. Friesner served in positions of increasing responsibility with Burger King Corporation. Before joining Burger King Corporation in October 2002, she was an audit manager at Pricewaterhouse Coopers in Miami, Florida.


text: Cybersecurity risk management and strategy We recognize the critical importance of maintaining the trust and confidence of our guests, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are embedded within our overall enterprise risk management ("ERM") program.


text: We have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and include the following components: • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Deployment of Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to cybersecurity threats, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans includes a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip them with effective tools to detect and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our Audit Committee oversees our ERM program, including the management of risks arising from cybersecurity threats. The Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Internal Audit function performs periodic audits of our cyber security program and reports results to the Audit Committee. On a periodic basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").


text: We have a dedicated team of cybersecurity specialists, led by our Chief Information Security Officer (CISO), who works in coordination with our senior management and leaders at each of our brands to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CISO has served in various roles in information technology and information security, as an IT auditor and an IT security executive, for over 38 years as of December 31, 2024, and has both the CISA and CRP designation. We also use a Managed Security Service Provider (MSSP) to provide continuous monitoring of our systems and supplement our internal security team.


text: While cybersecurity threats as a result of any previous cybersecurity incidents have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. For further discussion of risks related to cybersecurity, see the Risk Factors discussed under "Risks Related to Information Technology".


text: Executive Officers of Restaurant Brands International, Inc., General Partner of Registrant Set forth below is certain information about our executive officers as of February 20, 2025.


text: Patrick Doyle. Mr. Doyle, age 61, has served as Executive Chair of our Board since January 2023 and was appointed Executive Chairman of RBI in November 2022. Most recently, he served as an executive partner focused on the consumer sector of the Carlyle Group, a global diversified investment firm from September 2019 through November 2022. Prior to that he served as the chief executive officer of Domino's Pizza from March 2010 to June 2018, having served as president from 2007 to 2010, as executive vice president of Domino's Team USA from 2004 to 2007 and as executive vice president of Domino's International from 1999 to 2004.


text: Joshua Kobza. Mr. Kobza, age 38, was appointed Chief Executive Officer of RBI effective March 1, 2023. Prior to that, Mr. Kobza served as Chief Operating Officer of RBI from January 2019 to March 2023, as Chief Technology and Development Officer of RBI from January 2018 to January 2019, and as Chief Financial Officer of RBI from December 2014 to January 2018. From April 2013 to December 2014, Mr. Kobza served as Executive Vice President and Chief Financial Officer of Burger King Worldwide. Mr. Kobza joined Burger King Worldwide in June 2012 as Director, Investor Relations, and was promoted to Senior Vice President, Global Finance in December 2012.


text: Sami Siddiqui. Mr. Siddiqui, age 40, was appointed Chief Financial Officer of RBI in March 2024. Prior to that he served as President, Popeyes U.S. & Canada from September 2020, as President of Asia Pacific for RBI from February 2019 to September 2020 and as Chief Financial Officer for Burger King Corporation from October 2018 to February 2019. From September 2016 to September 2018, he was President of Tim Hortons and from April 2015 to September 2016, he was Executive Vice President, Finance for Tim Hortons. Mr. Siddiqui joined Burger King Corporation in 2013 and served various capacities within the Global Finance groups of Burger King Corporation prior to joining the Tim Hortons team. Prior to that, he worked in the Private Equity Group at Blackstone.


text: Axel Schwan. Mr. Schwan, age 51, was appointed as President, Tim Hortons Canada & US in October 2019 after serving as Global Chief Marketing Officer for Tim Hortons since October 2017. Mr. Schwan first joined RBI as Marketing Director, Germany, Austria and Switzerland in 2011 and was then appointed as Vice President, Marketing and Communications, EMEA for Burger King before advancing to the role of Global Chief Marketing Officer for the brand in January 2014. Prior to joining RBI, Mr. Schwan led the Schwan family restaurant business, alongside his sister, and worked in various marketing roles at Unilever and Danone in Germany.


text: Tom Curtis. Mr. Curtis, age 61, was appointed President, Burger King U.S. & Canada in October 2021. From May 2021 to October 2021, he was the Chief Operating Officer, where he was responsible for overseeing field operations, restaurant development and restaurant operations. Prior to joining BKC, Mr. Curtis spent 35-years at Domino's Pizza, Inc., where he most recently served as Executive Vice President, U.S. Operations and Global Operations Support, overseeing both franchise and company-owned operations from March 2020 to April 2021. Prior to that, he served as Executive Vice President, Corporate Operations from July 2018 to March 2020, and as Vice President of Franchise Relations and Operations Innovation from March 2017 to July 2018. Mr. Curtis joined Domino's in 2006, after being a Domino's franchisee since 1987.


text: Jeffrey Klein. Mr. Klein, age 49, was appointed President of Popeyes U.S. & Canada in March 2024. From June 2022 to March 2024, Mr. Klein held the position of Chief Marketing Officer of Popeyes U.S. & Canada. Prior to joining RBI, he served as Chief Marketing Officer of Little Caesars Pizza from April 2019 to June 2022. Prior to that, Mr. Klein spent 15 years leading CPG brand marketing for various brands at PepsiCo where he held several roles during his tenure, including Senior Vice President and Chief Marketing Officer of PepsiCo Foodservice.


text: Thiago Santelmo. Mr. Santelmo, age 40, was appointed President, International of Restaurant Brands International in March 2024. He previously served as President, EMEA starting in February 2022 and prior to that was President of the Latin America and Caribbean region. Mr. Santelmo has been with RBI since 2013, holding strategic roles including Head of Finance & Business development, EMEA. Prior to joining RBI, he worked at McKinsey & Company.


text: Duncan Fulton. Mr. Fulton, age 49, was appointed Chief Corporate Officer of RBI, in June 2018, overseeing global communications, North American franchising, government relations and ESG initiatives. Mr. Fulton also serves as Chairman of the board of directors for the Tim Hortons Foundation. Prior to joining RBI, Mr. Fulton held several positions with Canadian Tire Corporation (CTC) from November 2009 to March 2018, including Senior Vice President of Corporate Affairs, Chief Marketing Officer for FGL Sports and Mark's Work Warehouse, and President of FGL Sports. Previously, Mr. Fulton was Senior Partner and General Manager of Fleishman-Hilliard from April 2002 to November 2009. Prior to his agency experience, Mr. Fulton served as a communication advisor and spokesman for several political leaders, including former Canadian Prime Minister Jean Chr tien, Ontario Premier Dalton McGuinty and New Brunswick Premier Frank McKenna.


text: Jeff Housman. Mr. Housman, age 43, was appointed Chief People & Services Officer of RBI in April 2021 and previously served as Chief Human Resources Officer beginning in February 2017 as well as Head of Global Business Services from January 2015 to January 2017. Mr. Housman joined Burger King in April 2013 serving in finance, real estate and business services roles. Prior to joining Burger King, Mr. Housman worked in investment banking at J.P. Morgan.


text: Jill Granat. Ms. Granat, age 59, was appointed General Counsel and Corporate Secretary of RBI in December 2014. Ms. Granat served as Senior Vice President, General Counsel and Secretary of Burger King Worldwide and its predecessor since February 2011. Prior to this time, Ms. Granat was Vice President and Assistant General Counsel of Burger King Corporation from July 2009 until February 2011. Ms. Granat joined Burger King Corporation in 1998 as a member of the legal department and served in positions of increasing responsibility with Burger King Corporation.


text: Jacqueline Friesner. Ms. Friesner, age 52, was appointed Controller and Chief Accounting Officer of RBI in December 2014. Prior to that time, Ms. Friesner served in positions of increasing responsibility with Burger King Corporation after joining in October 2002. Previous to Burger King Corporation, she was an audit manager at Pricewaterhouse Coopers in Miami, Florida.


text: Executive Officers of the Registrant Set forth below is certain information about our executive officers as of February 20, 2024. President, Tim Hortons Canada & U.S.

companyName: Restaurant Brands International Inc.

ticker: QSR


text: Executive Officers of the Registrant Set forth below is certain information about our executive officers as of February 20, 2025.


text: Risk Management and Strategy The Company recognizes the critical importance of safeguarding sensitive information and responding effectively to cybersecurity threats or incidents. As a part of the Company's overall risk management strategy, the Company implements a lines-of-defense model for protecting the enterprise against cybersecurity related threats. The Chief Information Officer ("CIO") has first line responsibility for the protection of the Company against cybersecurity related threats, which includes evaluating potential threats and determining the appropriate responses. The Chief Information Security Officer ("CISO"), who reports to the CIO, is the executive accountable for the monitoring, continuous development and improvement of the Company's Information Security program. This program, which is aligned to the National Institute of Standards and Technology Cybersecurity Framework, (i) provides strategic oversight with respect to cybersecurity controls for the Company's technology, (ii) identifies potential risks in the Company's supplier ecosystem and (iii) outlines threat intelligence and incident response coordination for current and emerging cybersecurity risks. Additionally, the CISO and CIO continually evaluate and make updates to the Information Security program to align with regulatory requirements and industry best practices to keep company-wide training initiatives related to cybersecurity risks robust and up to date.

companyName: Walgreens Boots Alliance, Inc.


text: As part of the second line of defense, the Company maintains a Technology, Risk and Compliance ("TRC") function and a Company-wide Enterprise Risk Management ("ERM") program for which the WBA Chief Ethics and Compliance Officer provides oversight. The TRC function is responsible for reviewing and updating the Company's Information Security policy and manages compliance with critical security related regulatory requirements, including those related to HIPAA and the Payment Card Industry - Data Security Standard. The ERM program systematically identifies and reports enterprise-wide risks and the related risk mitigation recommendations, including the consideration of cybersecurity risk relative to other top risks, to executive management. The TRC and ERM teams work collaboratively with the Information Security team to support the Company's risk mitigation efforts.


text: The CISO partners closely with the Legal, Privacy and TRC teams, allowing for coordination with respect to policy design and providing domain expertise for incident response, as well as setting strategy. The CISO's updates to the overall risk management strategy and policy incorporate real-time operating metrics from the Company's technology environment as well as industry knowledge from team members and consultants, internal and external auditors, participation in professional peer networks, membership in Information Sharing and Analysis Centers, and commercial threat intelligence. Additionally, on a regular basis, the CISO briefs the CIO and other executive management committee members on emerging threats.


text: The Company has established a comprehensive Data Security Event Plan ("DSEP") which formalizes how the Company and management identify, investigate, respond to and report incidents involving unauthorized access to sensitive data. The DSEP is co-managed by the CISO, the Chief Privacy Officer and the Vice President of Technology Risk. The DSEP assists with establishing a repeatable process for management to identify the relative significance of incidents and defines internal and external reporting obligations. Response strategies are tailored to the circumstances of each incident, considering technical, business, legal and regulatory factors. Thorough documentation and data preservation are paramount throughout the investigation process. Once incidents are properly identified and assessed under the DSEP, communications are coordinated internally and escalated accordingly to the Audit Committee and the Board, as well as externally, to allow for timely dissemination of accurate information while adhering to legal and regulatory requirements.


text: The Company engages outside experts as needed to supplement in-house expertise with industry-leading experts for incident response and recovery, digital forensics, penetration testing, and outside counsel specializing in cybersecurity matters. To mitigate cybersecurity risks and threats arising from the Company's use of third-party service providers, the Company conducts proactive diligence on certain service providers' information security programs to help meet the Company's baseline cybersecurity standards as set by the CISO under the Information Security program.


text: In evaluating cybersecurity incidents, management considers the potential impact to customer privacy as well as results of operations, controls, and financial condition, as well as the potential impact, if any, to the Company's business strategy or reputation. As of the date hereof, we are not aware of any risks from cybersecurity threats, including risks from any past cybersecurity threats, that have materially affected our business or results of operations. However, future cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition. For more information on risks associated with cybersecurity threats, see the risk factor titled "Cybersecurity, Data Privacy and Information Security Risks" in Item 1A-Risk factors.


text: The Audit Committee, whose members include seasoned technologists and technology consultants, has been delegated responsibility for overseeing the Company's management of strategy with respect to data, privacy and cybersecurity risks.


text: The Audit Committee receives briefings from the CISO related to ongoing cybersecurity-related initiatives and cybersecurity risks, including emerging threats, at least quarterly. The Audit Committee then determines whether any such matters need to be presented to the full Board. Additionally, the Audit Committee regularly reviews and discusses with management, no less than annually, the Company's enterprise risk assessment and key enterprise risks in connection with the larger ERM program, which includes matters related to information security and technology risks, including cybersecurity. The CISO also provides an update directly to the full Board no less than annually regarding the overall health of the cybersecurity program.


text: The Company's CIO and CISO have over 40 years of combined experience in technology leadership roles for large, multinational corporations, including extensive experience in enterprise cybersecurity strategy, policy, incident response and controls.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include operational risks, intellectual property or trade secret theft, improper disclosure of confidential information, fraud, extortion, harm to employees or third parties with which we do business, and violation of data privacy or security laws.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT") audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; regular vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes.


text: We also leverage third-party expertise to audit and test our cybersecurity program. These include periodic reviews of cybersecurity threats and related controls, including reviews of periodic penetration tests conducted by independent third parties. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers. This includes proactive monitoring of third party's configurations, risk questionnaires for new technology vendors, and other processes to minimize risks associated with our third-party providers.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our confidential information and data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third parties.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see Risk Factors - "Our internal computer systems, or those of third parties with which we interact, may fail or suffer security breaches, which could result in a material disruption of the development of our product candidates and research programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business," in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The board's audit committee is responsible for the oversight of risks from cybersecurity threats and receives updates on a quarterly basis from management, including representatives from our IT, finance, and legal departments regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs.


text: Our day-to-day cybersecurity risk management and strategy processes are overseen by representatives from our IT, finance, and legal departments. Such individuals have an average of over 15 years of prior work experience in various roles involving IT security, auditing, compliance, data protection, privacy, risk management, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes, and report to the audit committee on any appropriate items.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding risks we face, see Risk Factors - "Our internal computer systems, or those of third parties with which we interact, may fail or suffer security breaches, which could result in a material disruption of the development of our product candidates and research programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business," in Item 1A of this Annual Report on Form 10-K.


text: The Company utilizes widely-recognized frameworks based on practices believed to be effective for managing cybersecurity risk, including the development of an organizational understanding of systems, assets, data and capabilities, and the development and implementation of safeguards and processes designed to ensure delivery of services and to detect, respond to and recover from cybersecurity events. Significant time and resources are devoted to the protection of the Company's systems and data, including the staffing of an experienced internal cybersecurity team, the use of a variety of preventative, detective and recovery tools, and engagement with external service providers to bolster the Company's cyber defense and response capabilities. Our Chief Information Officer (CIO) has over 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience. In addition, the Company's Internal Audit team includes members with information technology and cybersecurity expertise and training.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: In the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The Company maintains cyber liability insurance coverage to minimize any potential financial impacts from cybersecurity incidents that may occur.


text: The Company's Board of Directors provides oversight of the Company's cybersecurity risks through its Audit Committee. Four of the eight members of the Board of Directors, and three of the four Audit Committee members, possess skills related to information technology and cybersecurity. The Audit Committee reviews the Internal Audit team's cyber-related control audits to confirm that cyber risks are being appropriately managed and also reviews a periodic report produced by the CIO and CISO on the performance of the Company's cybersecurity program. In addition, the CIO and CISO present a comprehensive cybersecurity update to the full Board of Directors on at least an annual basis.


text: Risk Identification & Mitigation Cyber risk is incorporated into the Company's larger enterprise risk management practices, which include efforts to identify, assess, rank, treat, monitor and review risks. Cyber risks are assessed no less than annually by the CIO and CISO. Significant findings from these internal assessments are presented to management for incorporation into the enterprise risk management framework, and appropriate measures to mitigate and monitor the identified risks are developed and implemented. Strategic and emergent cyber-related efforts are shared with the wider information technology team and other stakeholders within the business for both informational and execution purposes.


text: The Company assesses and monitors third-party risks and closely tracks cyber threats such as ransomware and emergent web-based vulnerabilities. A variety of controls exist to minimize the impact of these risks and ensure each is managed within organizational tolerances, which controls are monitored by management for effectiveness. In addition, James River's Information Security Office conducts cybersecurity risk reviews on new and existing third-party vendors and business partners, which are presented to management so that either appropriate risk mitigation controls can be established with respect to such third-party or the Company can avoid engaging with such third-party if they are deemed to present an unacceptable level of risk.


text: Independent cybersecurity testing is performed by outside parties on at least an annual basis to identify opportunities for cyber control strengthening in the face of applicable threats. The results of these evaluations are reviewed and prioritized by the CIO and CISO based on their applicability and urgency to address gaps and drive continuous improvement. These findings, along with resultant enhancement and remediation efforts, are communicated with the Company's Board of Directors.


text: The Information Security Office conducts company-wide cybersecurity training, including through an annually required course of online training modules and a continuous email phishing test campaign. In addition, the CISO leads an annual cybersecurity tabletop exercise with company leadership to continually improve the organization's preparedness for cyber incidents. These exercises consider real-world events that could impact the business and seek to fine-tune response activities in an effort to minimize future cybersecurity incident impacts.


text: See Item 1A. Risk Factors - "We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.


text: The Company utilizes widely-recognized frameworks based on practices believed to be effective for managing cybersecurity risk, including the development of an organizational understanding of systems, assets, data and capabilities, and the development and implementation of safeguards and processes designed to ensure delivery of services and to detect, respond to and recover from cybersecurity events. Significant time and resources are devoted to the protection of the Company's systems and data, including the staffing of an experienced internal cybersecurity team, the use of a variety of preventative, detective and recovery tools, and engagement with external service providers to bolster the Company's cyber defense and response capabilities. Our Chief Information Officer (CIO) has more than 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience. In addition, the Company's Internal Audit team includes members with information technology and cybersecurity expertise and training.


text: The Company's Board of Directors provides oversight of the Company's cybersecurity risks through its Audit Committee. Three of the eight members of the Board of Directors, all Audit Committee members, possess skills related to information technology and cybersecurity. The Audit Committee reviews the Internal Audit team's cyber-related control audits to confirm that cyber risks are being appropriately managed and also reviews a periodic report produced by the CIO and CISO on the performance of the Company's cybersecurity program. In addition, the CIO and CISO present a comprehensive cybersecurity update to the full Board of Directors on at least an annual basis.


text: The Information Security Office conducts company-wide cybersecurity training, including through an annually required course of online training modules and a continuous email phishing test campaign. In addition, the CISO leads periodic cybersecurity tabletop exercises with company leadership to continually improve the organization's preparedness for cyber incidents. These exercises consider real-world events that could impact the business and seek to fine-tune response activities in an effort to minimize future cybersecurity incident impacts.


text: See Item 1A. Risk Factors — General Risk Factors "We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.


text: We design and assess our program based on the National Institute of Standards ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Shake Shack Inc.

ticker: SHAK


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: A security team led by our Chief Information Officer principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices adjusted as necessary. As part of our ongoing cybersecurity risk management program, we have from time-to-time identified risks or threats to our digital and corporate systems, including attempts to obtain team member credentials through bot and phishing attacks or through social engineering. While these risks and threats, as well as others we identify, require active and ongoing efforts to mitigate, we have not currently identified any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer, who has been designated as our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our Chief Information Officer, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our cybersecurity risk management program is informed by the National Institute of Standards and Technology ('NIST') Cybersecurity Framework ('CSF') and incorporates its principles in assessing, identifying, and managing cybersecurity risks relevant to our business. While we leverage the NIST CSF as a foundational guide, our program is tailored to our specific operational and risk environment.


text: A security team led by our Chief Information and Technology Officer principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a structured third-party risk management program that includes due diligence, contractual security requirements, and continuous monitoring for service providers, suppliers, and vendors to mitigate risks associated with external partnerships..


text: Cybersecurity risks are actively monitored through continuous security assessments, real-time threat intelligence, and adaptive security controls, enable proactive adjustments to our security program as threats evolve. As part of our ongoing cybersecurity risk management program, we have from time-to-time identified risks or threats to our digital and corporate systems, including attempts to obtain team member credentials through bot and phishing attacks or through social engineering. While these risks and threats, as well as others we identify, require active and ongoing efforts to mitigate, we have not currently identified any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information and Technology Officer ("CITO"), who has been designated as our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CITO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity risk management is led by our CITO, who has extensive experience in cybersecurity, information risk management, digital innovation, technology transformation, operations, and regulatory compliance. The CITO is supported by dedicated security professionals and external advisors to ensure a comprehensive and adaptive security strategy.


text: Risk Management and Strategy NerdWallet, Inc. recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and that of our users.

companyName: NERDWALLET, INC.

ticker: NRDS


text: We have adopted the National Institute of Standards and Technology - Cybersecurity Framework (NIST-CSF) to guide our risk assessment and management and promote a company-wide cybersecurity risk management culture. Our cybersecurity team works closely with our information technology (IT) department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engagement of Third Parties We enlist third-party cybersecurity assessors and consultants to evaluate and test both our risk management systems and the third-party risk management systems of our business partners. Through these collaborations, we tap into specialized knowledge and insights, helping us gauge the effectiveness of our cybersecurity strategies and processes. The findings from these assessments guide our decision-making and planning processes, influencing how we set priorities and allocate resources.


text: Overseeing Third-party Risk Before partnering with third-party providers, we conduct a thorough examination of their cybersecurity program, policies, and practices. This includes a review of their SOC 2 reports and any available penetration tests. Additionally, we actively monitor our primary service providers and regularly obtain security control reports from them. We also employ real-time monitoring to detect any suspicious activity promptly. This approach is implemented to minimize risks associated with data breaches or other security incidents that may arise from third-party sources.


text: Risks from Cybersecurity Threats To date, no cybersecurity incident or any risk from cybersecurity threats has materially affected, or has been determined to be reasonably likely to materially affect, us or our operations or financial condition.


text: The Board of Directors recognizes the critical importance of managing cybersecurity risks and has implemented robust oversight mechanisms designed to ensure effective governance in this area.


text: Audit Committee Oversight The Audit Committee, comprising Board members with diverse experience in risk management, IT, cybersecurity, and finance, is directly responsible for overseeing cybersecurity risks. Our Chief Information Security Officer (CISO) provides comprehensive quarterly presentations to the Audit Committee, covering ongoing cybersecurity initiatives, strategies, and emerging threats. The Committee reports significant matters to the full board, and the CISO also delivers an annual presentation to the Board of Directors.


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.


text: Risk Management Leadership The primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our highly experienced CISO. With two decades of cybersecurity expertise, including multiple CISO roles, our CISO plays a pivotal role in developing and executing our cybersecurity strategies. His responsibilities include overseeing governance programs, addressing known risks, leading employee security training, and executing the incident response plan in case of a cybersecurity incident.


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, human resources, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical corporate computer networks, third party hosted services and production computing environment utilized to provide our services, and our critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer-related data ("Information Systems and Data").

companyName: CS Disco, Inc.

ticker: LAW


text: Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product Officer, Senior Vice President of Engineering and General Counsel), identify, assess and manage the Company's cybersecurity threats and risks (the "Cybersecurity Function"). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry's risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, systems monitoring, and access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the security organization works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. We conduct a cybersecurity risk assessment for vendors that manage, host or process our Information Systems and Data. Depending on the vendor, the program includes a security assessment questionnaire, a review of existing security assessments or reports related to the vendor and the use of third-party risk assessment services and scoring. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section referred to as: "If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of management's assessment and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over eight years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.


text: Various individuals that are part of our Cybersecurity Function are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including various management personnel that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer. Various individuals that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer, work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and full board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.