text: Our service providers, and third-party hardware or software applications on our networks and company-issued devices, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so that employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.

companyName: MARZETTI CO

ticker: MZTI

secItem: Item 1C


text: While we have been subject to cyber attacks, the expenses (including penalties and settlements, of which there were none) related to such incidents were immaterial, and the risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats. Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee ("ERM Committee"), as well as directly from our Chief Information Officer ("CIO") or VP Infrastructure, periodically, as appropriate. These reports cover various cybersecurity matters, including risk assessments, risk prevention and mitigation activities, and incident reports along with remediating actions, areas of emerging risks, industry trends, and other areas of importance. Furthermore, our Audit Committee oversees our annual enterprise risk assessment. This assessment encompasses key risks associated with security, technology, and cybersecurity threats in the same manner as other key risks.


text: Our cybersecurity risk management processes are led by our CIO and our VP Infrastructure. Our CIO has served our company in that capacity since 2018 and held CIO or other IT and cybersecurity leadership roles at other companies for more than 10 years prior to that. He has a master's degree in computer systems from the Naval Postgraduate School. Our VP Infrastructure, who is responsible for our information technology infrastructure and our information security strategy and operations, has more than 30 years of experience in information technology, serving in senior IT leadership roles with responsibility for cybersecurity at our company since 2007. His IT expertise was established prior to that through education and work experience in a variety of technical positions in the consumer goods, health care, and aerospace industries. They are supported by a team of skilled information security professionals within our Information Technology function. This team provides periodic updates to our ERM Committee, composed of our Chief Executive Officer, Chief Financial Officer, General Counsel, and other members of our senior leadership.


text: RISK MANAGEMENT AND STRATEGY We have processes to identify, assess, monitor, and manage material risks related to information technology, including, but not limited to: cybersecurity threats, vulnerability management, incident management, data protection and retention, recoverability, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.


text: Our service providers, and third-party hardware or software applications on our networks, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.


text: While we have been subject to cyber incidents, the expenses (including penalties and legal settlements, of which there were none) related to such incidents were immaterial. The risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.


text: RISK MANAGEMENT AND STRATEGY Processes for Assessing, Identifying, and Managing Cybersecurity Risks The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our information systems (as defined in Item 106(a) of Regulation S-K) and data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents (as defined in Item 106(a) of Regulation S-K). • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: 24/7 Security Operations Center Managed Services ("SOC") to monitor our cyber environment, correlate logs from all technology assets to identify potential signs of compromise and perform threat hunt exercises. Enterprise-grade email security system managed services. Perform penetration tests, vulnerability assessments, and vulnerability scans of our customer-facing sites, among others.


text: Prevention of denial-of-service attacks • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents. • Policies and procedures related to cybersecurity matters, including but not limited to Acceptable Standards of Use of Technology Systems, Confidential/Sensitive Information and Credit Card Handling Policy, encryption standards, antivirus protection, wireless and remote access, multi-factor authentication, access and change control, and physical security. • Employee cybersecurity awareness by performing ongoing phishing exercises, and mandatory privacy and cybersecurity training (including spear phishing and other awareness training) for employees.


text: Material Effects of Cybersecurity Threats On February 3, 2025, we experienced a systems outage caused by a cybersecurity attack by threat actors who unlawfully accessed our network, encrypted critical applications, and exfiltrated certain files (herein defined as the "Cyber Incident"). Upon discovery, we promptly activated our incident response plan, engaging both internal teams and third-party cybersecurity experts.


text: During the year ended September 28, 2025, we incurred $10.5 million loss of cash flows related to the Cyber Incident. Approximately $3.7 million of this was incurred expenses that are recognized in "Restructuring and Other" in the Consolidated Statements of (Loss) Income and Comprehensive (Loss) Income. We have filed insurance claims for the remaining $6.8 million to cover business interruption and other costs. The Cyber Incident remains under legal and forensic investigation, including evaluation of the extent and potential risk related to unauthorized access to sensitive data.


text: The incident had a significant negative impact on our 2025 operating results. Various revenue lines were impacted, certain operating expenses were higher than they were prior to the incident, and many projects underway were significantly delayed.


text: For a description of the risks related to cybersecurity that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Cybersecurity" section of this Report.


text: Board of Directors Oversight The Board of Directors plays a crucial role in overseeing our management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and our response to significant incidents.


text: Management's Role in Cybersecurity Risk Management Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on our cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.


text: We rely on information systems to obtain, process, analyze, and manage data, as well as to facilitate the manufacture and distribution of inventory to and from our facilities. We receive, process, and ship orders, manage the billing of and collections from our customers, and manage the accounting for and payment to our vendors. We also manage our production processes with certain industrial control systems. Consequently, we are subject to cybersecurity risk.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: From time to time, we have experienced immaterial cybersecurity threats and incidents. When these threats and incidents have occurred, we have taken appropriate remediation steps and, through investigation, determined that the threats or incidents did not have a material effect on our business, results of operations, or financial results.


text: Cybersecurity Risk Management and Strategy We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.


text: Cybersecurity threats are identified, assessed, and monitored by our security operations center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors. When a cybersecurity threat or incident meets certain categorized thresholds as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our Chief Executive Officer (CEO), Chief Financial Officer, Chief Human Resources Officer, Chief Information Officer, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.


text: We have integrated cybersecurity risk into our overall enterprise risk management (ERM) process. Pursuant to the ERM process, cybersecurity risk is evaluated for likelihood, significance, and velocity on a semiannual basis by designated risk owners. The risk owners consist of a cross-functional group of leaders, led by our CISO. Based on the ERM analysis, we adjust, if necessary, our process for the identification, assessment, and monitoring of cybersecurity threats and incidents.


text: We engage third parties in connection with our cybersecurity identification, assessment, and response processes, including to periodically benchmark our cybersecurity program against the National Institute of Standards and Technology's Cybersecurity Framework. We also maintain active retainers with certain third parties that can be engaged in the event of a cybersecurity threat or incident. We have established a process to oversee and identify risks and cybersecurity threats associated with our third-party service providers, which includes the use of monitoring technology. We also survey certain third-party providers regarding their security controls.


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have accelerated multiple cybersecurity program enhancement efforts, including expansion of resources, increased visibility, and stronger protective controls. In 2024, we expect to spend roughly $9 million in maintaining and enhancing our cybersecurity protection efforts. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 24, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the CISO, or the CEO in coordination with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities regarding the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since 2022, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. The CISO holds a bachelor's degree in electrical engineering from Arizona State University and is a Certified CISO under the Carnegie Mellon University CISO Certification Program, a Certified Information Systems Auditor (CISA), and a Certified Information Systems Security Professional (CISSP). Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.


text: Although we have purchased broad form cyber insurance coverage and believe that our cybersecurity protection systems are adequate, cybersecurity risk has increased due to remote access, remote work conditions, and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems, including those resulting from ransomware attached to our industrial control systems. If these systems are interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. For more information regarding cybersecurity risks, refer to Information Technology and Cybersecurity Risk Factors on page 24.


text: Cybersecurity Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.


text: Cybersecurity threats are identified, assessed, and monitored by our Security Operations Center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors to cover continuous monitoring. When a cybersecurity threat or incident meets certain categorized thresholds, as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our CEO, CFO, CHRO, CIO, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have increased our cybersecurity program enhancement efforts, including stronger protective controls. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 23, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the Company's CIO, or the CFO in coordination with the CIO, each after consultation with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since October 2024, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. Our CISO holds a Bachelor of Science degree from DeVry University, Addison, Illinois, a Masters in Business Administration from Western Governors University, is a Certified Information Systems Security Professional (CISSP), a GIAC Certified Incident Handler (GCIH), and holds a GIAC Certification in Strategic Planning, Policy and Leadership. Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.


text: Although we have purchased broad form cyber insurance coverage and strive to provide a balanced level of cybersecurity protections, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of cybersecurity attacks, including malware. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems or bypass our detection capabilities, including those resulting from ransomware attached to our industrial control systems. If these systems are materially interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. We may also be required to devote significant management resources and expend significant additional resources to address problems created by any such interruption, damage, or failure. For more information regarding cybersecurity risks, refer to Item 1A. Risk Factors - Information Technology and Cybersecurity Risk Factors on page 23.


text: We have a comprehensive approach to identifying and managing cybersecurity risks that involves our information technology security personnel, senior management, Audit Committee and Board of Directors. Our cybersecurity risk management function is integrated into our overall risk management system and processes.

companyName: VECTOR GROUP LTD


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate and real estate segments and oversees a team of dedicated cybersecurity personnel employed in our tobacco segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.


text: Cybersecurity incident identification and response. We use a number of processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: After an incident, we would review and document the causes and effects of the incident, evaluate the remediation plan, and consider post-incident improvements. Where applicable, the CTO reports these findings to the Audit Committee and, when appropriate, the Board of Directors.


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply in the event of a cybersecurity incident at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.


text: Cybersecurity risks and threats. We and certain of our third-party service providers have experienced, and may continue to experience, internal and external cybersecurity threats, which can result in impacts to critical data and confidential or proprietary information and the disruption of certain business operations. Nonetheless, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, and we cannot provide assurance that cybersecurity incidents will not have a material impact in the future. See Item 1A. "Risk Factors".


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and to respond to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information and escalation components designed to inform management and the board of directors of prospective risks and developments.

companyName: ELI LILLY & Co

ticker: LLY


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications.


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our Information Security team utilizes various tools to prevent, detect, monitor, and react to cybersecurity threats. Our Incident Response Playbook outlines processes, roles, responsibilities, engagements, escalations, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, escalations, and communications, including an evaluation of any necessary or required disclosure. Roles and escalation paths range from within the Information Security team up to the Executive Committee, and the board of directors and its committees, as appropriate.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations— Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems" and "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business."


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is also composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with our CIDO and CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. In addition, the ethics and compliance committee supports the audit committee and board in oversight of legal and regulatory compliance. Our board of directors also regularly participates in presentations on cybersecurity and information technology. In addition to regular presentations, management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks, including, among others, the U.S. National Institute of Standards and Technology Cybersecurity Framework, with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and responding to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information sharing and escalation components designed to inform management and the board of directors of prospective risks and developments.


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications. For companies we acquire, the integration process includes plans for alignment with relevant information security policies and procedures and timelines for implementation.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations—Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems", "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business", and "Risk Factors—Risks Related to Our Operations—Our use of artificial intelligence (AI) or other emerging technologies could adversely impact our business and financial results."


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. The Company's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: The work done by each of these divisions is applied both tactically and strategically to operations, as well as to broader risk management activities.


text: The governance, risk and compliance division of our Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the Company's most significant IT and cyber risks, the results of which are leveraged by the Company's IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.


text: The work done by the Information Security team integrates into the Company's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on the Company's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, the Company's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the Company's IT leadership team and the Audit Committee of the Company's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.


text: While our Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.


text: Monitoring and Incident Response The CSRI division of our Information Security team is responsible for the operation of our internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of Lincoln's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from the Company's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.


text: Our Privacy team, which is part of the Company's compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into our Information Security incident response program. The Information Security team works closely with our Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of our Information Security team, we operate a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the Company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with our procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of our operational risk management team's broader periodic review of third parties.


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems or the information systems of third parties on which we rely may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses" and 'Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: The Company's Board of Directors is responsible for regular oversight of the Company's overall risk management process. The Board reviews the most significant risks the Company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the Board of Directors.


text: The Company's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with our Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. We also have a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and the Company's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by our CISO. The head of each of the four divisions of our Information Security team reports directly to the CISO. The CISO reports directly to the Company's Chief Information Officer and Head of IT ("CIO"), who is a member of the Company's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the Company and cybersecurity developments generally. In addition, as discussed above, the Company's Internal Audit team reports to the Audit Committee the results of its annual security audit focused on cybersecurity risks. The Company's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the Audit Committee on a quarterly basis.


text: Our current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of our Information Security team, we operate a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third-party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the Company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with our procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of our operational risk management team's broader periodic review of third parties.


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses," "Item 1A. Risk Factors – Operational Matters – We are subject to third-party information system and other operational risks due to our reliance on third-party vendors and suppliers and the outsourcing of certain of our business operations" and "Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: The Company's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with our Chief Information Security Officer (" CISO ") having primary responsibility with respect to material risks from cybersecurity threats. We also have a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and the Company's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by our CISO. The head of each of the four divisions of our Information Security team reports directly to the CISO. The CISO reports directly to the Company's Chief Information Officer ("CIO"), who is a member of the Company's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the Company and cybersecurity developments generally. In addition, as discussed above, the Company's Internal Audit team reports to the Audit Committee the results of its annual security audit focused on cybersecurity risks. The Company's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the Audit Committee on a quarterly basis.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important component of our overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the parent company and our subsidiaries.

companyName: LOEWS CORP

ticker: L


text: The parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect each entity against cybersecurity risks and foster each entity's ability to respond to cybersecurity events. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, incident response plans and data security assessments of third-party service providers as a part of vendor management.


text: Risks from cybersecurity threats, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our results of operations and/or financial condition. For more information about these risks, see the risk factor titled "Failures or interruptions in or breaches to our or our subsidiaries' computer systems or information technology or communication infrastructure or those of our third party vendors could materially and adversely affect our or our subsidiaries' operations" under Item 1A.


text: Our Board has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our and our subsidiaries' management, including our and our subsidiaries' senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Senior IT leadership (generally, chief information officers and/or chief information security officers) at the parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated from senior IT leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our and our subsidiaries' senior IT leadership.


text: Risks from cybersecurity threats, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our and/or their business, results of operations, cash flows, financial condition and/or equity. For more information about these risks, see the risk factor titled "Failures or interruptions in or breaches to our or our subsidiaries' computer systems or information technology or communication infrastructure or those of our third party vendors could materially and adversely affect our or our subsidiaries' operations" under Item 1A.


text: Risk Management and Strategy LP places utmost priority on ensuring consistent and uninterrupted operational capability, as well as securing confidential business assets. We have systems and processes in place to assess, identify and manage cybersecurity incidents, and those systems and processes are integrated into our overall enterprise risk management system. We invest heavily in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents, and we have maintained a strong focus in consistently reviewing fundamental cybersecurity practices and ensuring we are reviewing emerging threats.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: To respond to the threat of security breaches and cyberattacks, we maintain a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, LP. This program includes mechanisms to monitor and detect unusual network activity, cybersecurity incident response and containment tools, and a response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees receive training and are tested routinely through simulated phishing attempts.


text: We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct an annual Security Program Assessment under the Capability Maturity Model Integration framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information, could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.


text: Management Responsibilities Our cybersecurity program is managed by our Information Security Officer (ISO). Our ISO has over six years of cybersecurity experience working in publicly traded companies, with expertise leading risk remediation efforts in vulnerability management, network security, security awareness, threat monitoring, data security and cloud security.


text: To more effectively share information and gain consensus regarding cybersecurity initiatives and prevention policies, the Company has in place an Enterprise Risk Management Committee consisting of various members of LP senior leadership including the Chief Legal Counsel and Chief Financial Officer. The Enterprise Risk Management Committee is chaired by our Chief Tax Officer. The ISO, along with her team, is responsible for leading an enterprise-wide information security strategy, including policy, standards, architecture, processes, and security technology. The Enterprise Risk Management Committee (i) meets quarterly and as-needed to review and discuss the Company's risks, including cybersecurity threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging threat landscape and (ii) reports risks related to any material cybersecurity incidents, as needed, to the Board of Directors and the Finance and Audit Committee (FAC) of the Board of Directors.


text: Board Responsibilities Oversight of risks from cybersecurity threats is shared by the Board of Directors and the FAC. The FAC oversees our cybersecurity program. The ISO provides the FAC with an annual presentation on our cybersecurity program, emerging threats, and the state of LP's cybersecurity maturity. In addition, the ISO provides updates to the FAC no less often than annually with respect to additional information regarding the cybersecurity program.


text: We maintain a robust cybersecurity program that we have designed with the goal of identifying, deterring, detecting, responding to, and managing potential cybersecurity risks and threats.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Risk Management and Strategy Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).


text: Processes and Procedures We have adopted physical, technological, and administrative controls on cybersecurity. Our risk management processes include, among others, the following features: • We leverage the National Institute of Standards and Technology security frameworks as well as established internal security standards, industry practices, and applicable regulatory requirements. Our program is designed to comply with a range of applicable industry standards, such as the Payment Card Industry Data Security Standard. • We maintain cybersecurity insurance coverage that provides protection against potential losses arising from certain cybersecurity incidents. • We require that cybersecurity awareness and data privacy training, along with company-wide and tailored training programs, be provided to associates annually. We also regularly conduct phishing and social engineering simulations, and host events to increase awareness, including an annual cybersecurity awareness summit and monthly campaigns. • We have a cybersecurity incident response plan in place which provides a framework for responding to cybersecurity incidents. Our information security team leverages technologies and vendors to monitor and respond to security threats via a dedicated security operations center. In the event of a security incident, a defined procedure outlines containment, response, and recovery actions that draw on resources and leadership across the Company, as needed. • A cross-functional team conducts periodic simulated exercises, and we perform regular vulnerability scanning and conduct vulnerability testing during the software development life cycle. • We collaborate with internal stakeholders and third-party assessors and consultants to conduct regular reviews, tests, and audits of our security program. This coordinated approach reviews security controls that safeguard our information assets, including payment information, through processes such as security control assessments and third-party penetration testing. Additionally, we utilize tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other evaluations to improve our security measures and strategies. • We also participate in various cybersecurity and retail industry groups to remain apprised of emerging cybersecurity risks, defense, mitigation strategies, and governance best practices.


text: Third-Party Risk Management Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We have developed contracting processes and terms to gain commitments from certain vendors and third-party service providers to adhere to appropriate security practices and outline specific security requirements and expectations, including compliance with industry standards, applicable laws and regulations, and our internal security policies. We regularly evaluate and assess vendor risk levels based on a variety of factors, such as the nature of shared data, potential impact to business continuity, and vendors' security posture. Our processes extend beyond initial evaluations to include proactive monitoring and routine oversight.


text: Cybersecurity incidents and risks of which we are aware as of the date of this Form 10-K have not materially affected our business strategy, results of operations, and financial condition, although we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, reputation, results of operations, or financial condition. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Our Chief Digital and Information Officer (CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.


text: The CDIO has served in various roles in information technology for over 25 years, holds undergraduate and graduate degrees in electrical and electronics engineering and computer science, and brings significant insights into cybersecurity strategies. The CISO has served in various roles in information security for over 30 years, including serving as a CISO of four public companies. The senior members of the information security group who report to the CISO have extensive experience in technology and security roles from serving with several large public companies and possess cybersecurity certifications, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor, among others.


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, and privacy matters. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.


text: Risk Management and Strategy Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs.


text: As part of our focus on the use of AI technology in our business, we developed an AI cybersecurity strategy designed to enable the building of secure and reliable AI systems while also managing ethical, legal, cyber, data privacy, and other technology risks. The Company also established an AI Governance Committee, which is composed of leaders across a variety of business, technology, and support functions, to oversee the creation and implementation of risk control and strategic implementation frameworks. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).


text: Our Chief Digital and Information Officer ( CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, privacy, and significant emerging technology. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.


text: We recognize the importance of assessing, identifying and managing material risks associated with any "cybersecurity threat," as such term is defined in Item 106(a) of Regulation S-K. We assess cybersecurity risk on an annual basis and whenever management deems there to be a significant change to exposure or external threats. We also have several enterprise-wide and business unit-specific cybersecurity processes, technologies, and controls to aid in our efforts to identify, evaluate, and respond to such cybersecurity risk. As part of our cybersecurity risk management processes, we leverage our membership in the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) and utilize carefully vetted third-party information technology systems vendors to conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing. We consider cybersecurity risks associated with our use of third-party information technology vendors during the selection process and include ongoing monitoring as part of our cybersecurity processes. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident," as such term is defined in Item 106(a) of Regulation S-K.

companyName: TELLURIAN INC. /DE/


text: Chaired by Jonathan Gross, who holds the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD) and Carnegie Mellon University, the Cybersecurity Committee of the Company's Board of Directors is responsible for assisting the Board of Directors in fulfilling its oversight responsibilities with respect to (i) cybersecurity risks and (ii) policies and practices to monitor and mitigate cybersecurity risks. The Company's Board of Directors and its Cybersecurity Committee are briefed regularly on Tellurian's cybersecurity risks and other cybersecurity-related matters. Additionally, we have established the Cybersecurity Management Committee to provide executive oversight of our cybersecurity risk management processes. The Cybersecurity Management Committee is chaired by Michael Dean, our Chief Information Security Officer (CISO), who has over 30 years of cybersecurity management and information technology leadership experience, and includes our Chief Executive Officer, President, General Counsel and Chief Accounting Officer, among other members of our management team. The Cybersecurity Management Committee holds regular meetings at least quarterly and special meetings as necessary to review identified cybersecurity threat risks or incidences and monitor the operation of our incident response plan. As part of our incident response procedures, our CISO is required to report any identified material cybersecurity incident promptly to our Chief Executive Officer, our President and the Cybersecurity Committee.


text: Cybersecurity Governance We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in connection with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.

companyName: MARCUS CORP

ticker: MCS


text: The information security operations team within our information technology function reports to our Chief Information Officer, who regularly updates our Board of Directors and the Audit Committee. The function is governed by various policies on different aspects of cybersecurity. Our Board of Directors and the Audit Committee, as applicable, then reviews such information, including management's proposed mitigation strategies and plans, to monitor our progress on mitigating the risks.


text: Our Chief Information Officer and General Counsel meet regularly with the Board of Directors and its committees to review relevant areas including: • Key metrics of the information security/cybersecurity program; • The purchase of cybersecurity risk insurance to mitigate exposure to the company; • Monitoring and testing of backup and disaster recovery process; • Cybersecurity incident response and remediation procedures; and • Metrics of the company's training and compliance program on information security and awareness of cyber risk.


text: In addition, we have a management Cybersecurity Committee, which functions as a steering committee, to provide oversight and strategic direction for the cybersecurity program. The Cybersecurity Committee is comprised of our Chief Information Officer & Theatres Chief Information Technology Officer ("CIO"), Hotels Chief Information Technology Officer, Vice President of Information Security, General Counsel, and Chief Financial Officer. The Cybersecurity Committee meets quarterly to review the cybersecurity program, including risks and the status of key initiatives.


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years, and has attained the professional certifications of PCI-ISA and PCI-DSS. Our General Counsel and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management Strategy In addition to our Cybersecurity Committee, an information security operations team is in place, which monitors the environment for cybersecurity incidents on a continuous basis. We have also established incident response plans to assess and manage cybersecurity incidents. These plans, which are tested at least annually, include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to the company, are escalated to the Cybersecurity Committee. The Cybersecurity Committee, in coordination with internal and external advisors and legal counsel, is responsible for determining the materiality of cybersecurity incidents and coordinating any necessary disclosures. A materiality decision framework, which includes both quantitative and qualitative factors, is in place to guide the materiality decision. Critical cybersecurity incidents which are determined to be material are escalated to the Audit Committee, and when appropriate, to the Board of Directors.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective knowledge, tools, and awareness to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. The personnel training occurs at the time of hiring and at least once annually thereafter. The Cybersecurity Committee, along with other members of executive management, practices the incident response process through an annual tabletop exercise facilitated by external consultants.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, disaster recovery testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: A third-party risk management program is in place to address the risks posed by third parties. Through this program, the company evaluates the type of data that is shared with the third party and gains an understanding of the third party's cybersecurity risk profile. Higher risk third parties complete a vendor security self-assessment designed to provide a deeper level of understanding of the third party's risks and controls. Based on the results of this assessment, the entity may be added to our third-party monitoring solution, which provides updates and alerts related to the company's externally facing security posture.


text: Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the company, including its business strategy, results of operations or financial condition.


text: Cybersecurity Governance We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in consultation with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years. Our General Counsel and Chief Financial Officer each holds undergraduate and graduate degrees in their respective field, and each has significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework and ISO/IEC:27001, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Our cybersecurity risk management program is coordinated by cross-functional teams, including risk management, legal and compliance, business resiliency management and information security. These teams develop, implement and maintain our compliance policies, programs and training, business resiliency, disaster recovery and information security frameworks, solutions and procedures. They also work closely with our business, internal audit, finance and IT staff to identify, assess and mitigate risks, including those associated with our use of third-party vendors and service providers, and to monitor and take steps designed to prevent security incidents in our technology environment.


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multifactor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.


text: Our Board of Directors has overall oversight responsibility for the Company's risk management and receives updates from management throughout the year on cybersecurity matters and other material risks facing the Company. Additionally, the Audit Committee regularly reviews the Company's policies and practices with respect to risk assessment and risk management, including cybersecurity risks, and reports to the full Board of Directors on a regular basis. The Audit Committee is responsible for overseeing the Company's enterprise risk management policies and processes, including discussing with management the Company's major risk exposures and the steps that have been taken to monitor and control such exposures, including those arising from cybersecurity risks.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis. Management's efforts include establishing processes designed to ensure that potential cybersecurity risks are monitored, putting in place mitigation and remedial measures and implementing and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). Our CIO has significant expertise and over a decade of experience working in technology. Our CISO has over twenty years of experience working in cybersecurity and maintains a Certified Information Systems Security Professional certification. Our CISO and CIO receive reports from our cybersecurity team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity team is comprised of experienced information systems security professionals and information security managers with many years of experience and various security certifications.


text: Management, including the CIO and CISO, regularly reviews with the Board of Directors and the Audit Committee the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Audit Committee outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, please see "Risk Factors – Cybersecurity, Data Protection and Technology Risks" in this annual report on Form 10-K.


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multi-factor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.