text: Security Policy and Requirements: The Coherent Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment and prioritization, and as necessary, remediation plans. The Cybersecurity Team also performs periodic system penetration testing to validate the Company's security controls and assess Coherent's infrastructure and applications. All employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, the IT group and the Cybersecurity Team participate in annual tabletop exercises designed to simulate a response to a cybersecurity incident. The Cybersecurity Team incorporates the findings from these exercises into the Coherent processes. Further, in 2023, select members of the senior management team and the Cybersecurity Team participated in a tabletop exercise.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties. This includes external third parties that may have permission to access Coherent IT systems and assets, such as consultants, and review of the systems of third parties that could adversely impact Coherent's infrastructure in the event of a cybersecurity incident affecting those third-party systems, such as through vendors and other service providers.

companyName: COHERENT CORP.

ticker: COHR

secItem: Item 1C


text: The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact Coherent or Coherent's operations to date. However, the Company recognizes the ever-evolving cyber risk landscape and cannot provide any assurances that it will not be subject to a material cybersecurity incident in the future.


text: We maintain a risk based approach to identify cybersecurity threats, and conduct assessments to determine if our information systems are vulnerable to such cybersecurity threats. This includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: We maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer and Global Head of Cybersecurity, to manage the risk mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage consultants, auditors, or other third parties. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: Like any other technology company operating in today's environment, we have experienced cybersecurity incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Cybersecurity attacks and incidents and other vulnerabilities could subject us to costly damages, claims and expenses, harm to our reputation or competitive position, or disrupt our operations and business."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cyber security threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Nominating and Corporate Governance ("NCG") Committee.


text: The NCG Committee is briefed quarterly by management on, among other things, our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. The NCG Committee provides regular updates to the Board of Directors on such reports.


text: Our Chief Information Officer and Global Head of Cybersecurity have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cyber security policies and processes, including those described in "Risk Management and Strategy" above. Our Global Head of Cybersecurity monitors and keeps informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our cybersecurity team, and through the use of technological tools and software and results from third party assessments.


text: The Company is committed to ensuring the safe operation of its business by means of a dedicated cybersecurity program designed to protect the confidentiality, integrity, and availability of its assets from cybersecurity threats. The Company's customers, suppliers, and joint venture partners also face cybersecurity threats, and a cybersecurity incident impacting the Company or any of these entities could materially impact our operations, performance, and results of operations. New and evolving cybersecurity threats and related risks make it imperative that the Company allocates the appropriate resources to mitigate these risks, adapts to the changing cybersecurity landscape, and responds to emerging threats in a timely and effective manner.

companyName: Andersons, Inc.

ticker: ANDE


text: The underlying controls of the Company's cybersecurity program are designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") standards for cybersecurity and information technology. The controls in the Company's cybersecurity program include but are not limited to, endpoint threat detection and response, privileged access management, logging and monitoring, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability, and patch management. Management regularly assesses the Company's cybersecurity capabilities and has implemented policies, processes, and technology that it considers appropriate to reduce the likelihood or impact of a breach.


text: Third parties also play a role in the Company's cybersecurity. The Company engages third-party contractors to assess cybersecurity controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of these cybersecurity controls. The Company engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in the Company's information technology environment. Management also shares and receives threat intelligence with our peers, local public companies, and cybersecurity associations.


text: The Company's Senior Manager of Information Security, reporting to the Vice President of Information Technology, is the leader of the Company's cybersecurity team. The Senior Manager of Information Security is responsible for assessing and managing the Company's cybersecurity program, informs the Vice President of Information Technology and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Senior Manager of Information Security and Vice President of Information Technology have decades of collective experience in managing information technology and cybersecurity functions, both at the Company and in prior positions. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.


text: Employees outside of the cybersecurity team also have a role in our cybersecurity defenses and they are engaged in a culture supportive of security protocols, which management believes improves the Company's cybersecurity. All employees are required to complete cybersecurity trainings annually and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. The internal business owners of hosted applications are required to document user access reviews at least annually and receive a System and Organization Controls ("SOC") 1 or SOC 2 report from the vendor. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, management will take additional steps to assess the vendor's cybersecurity preparedness.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity program and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's Vice President of Information Technology regularly addresses the Audit Committee, typically on a quarterly basis, regarding our cybersecurity and data privacy progress to the NIST CSF standards along with briefing the Committee on any cybersecurity incidents that were determined to have a moderate or higher impact on the business, even if immaterial to the Company as a whole. In the event of an incident, management intends to follow the Company's incident response plan, which outlines the steps to be followed from the detection of an incident to mitigation, recovery, and notification, including notifying functional areas, as well as senior leadership and the Audit Committee, as appropriate. Determination of when to notify senior leadership and the Audit Committee is made by the Vice President of Information Technology in consultation with other members of senior leadership as needed. Depending on the nature and severity of the incident, disclosure can be handled either through scheduled quarterly reporting to the Audit Committee or as an immediate disclosure to the Chair of the Audit Committee.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into the Company-wide ERM process. On an annual basis, management assesses the top risks facing the enterprise through the Company's ERM process. Cybersecurity related risks are included in this annual function and to the extent the ERM process assigns a heightened risk to cybersecurity, risk owners are named to address the severity, likelihood, and controls in place to mitigate these risks. Upon the conclusion of the ERM process, management's assessment is then presented to the Board of Directors.


text: Notwithstanding the attention the Company pays to cybersecurity risks and the processes and controls implemented, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, strategy, financial condition, results of operations, cash flows, and reputation. Cybersecurity risks rapidly evolve and are complex, so the Company must continually adapt and enhance processes and controls. As the Company does this, management must make judgments about where to invest resources to protect the Company and our assets most effectively. These are inherently challenging processes, and management can provide no assurance that the processes and controls implemented will be effective.


text: The Company has experienced, and expects to continue to experience, cyber incidents in the normal course of business. Cybersecurity threats, including as a result of previous incidents, to date, have not had, and as of the date hereof we do not believe are reasonably likely to have, a material adverse effect on the Company's business, strategy, financial condition, results of operations, or cash flows. However, for the reasons described above, management cannot guarantee that the Company will not be materially affected in the future. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for further discussion of cybersecurity risks.


text: The Company's Director of Information Security ("CISO"), reporting to the Chief Information Officer ("CIO"), is the leader of the Company's cybersecurity team. The CISO is responsible for assessing and managing the Company's cybersecurity program, informs the CIO and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our CISO and CIO have decades of collective experience managing information technology and cybersecurity functions, both at the Company and in prior positions at large, Fortune 500 global businesses. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity program and the steps taken by management to monitor and mitigate cybersecurity risks. The CIO regularly addresses the Audit Committee, typically on a quarterly basis, regarding our cybersecurity and data privacy progress to the NIST CSF standards along with briefing the Committee on any cybersecurity incidents that were determined to have a moderate or higher impact on the business, even if immaterial to the Company as a whole. In the event of an incident, management intends to follow the Company's incident response plan, which outlines the steps to be followed from the detection of an incident to mitigation, recovery, and notification, including notifying functional areas, as well as senior leadership and the Audit Committee, as appropriate. Determination of when to notify senior leadership and the Audit Committee is made by the CIO in consultation with other members of senior leadership as needed. Depending on the nature and severity of the incident, disclosure can be handled either through scheduled quarterly reporting to the Audit Committee or as an immediate disclosure to the Chair of the Audit Committee.


text: The UScellular information security program aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Risk assessments are conducted periodically leveraging this standard and are integrated into the UScellular Enterprise Risk Management (ERM) program. The assessment results are used to drive continuous improvement in the UScellular cybersecurity control environment, as well as to manage potential data security risks of third-party service providers. UScellular assesses the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. UScellular manages these evolving risks through ongoing investments in the security program including active monitoring of the internal data environment and the environments of third-party service providers who manage sensitive data. In addition, UScellular Information Technology leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack. UScellular leverages external parties to perform independent assessments and tests of security controls in the environment.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: UScellular's Information Technology Security leaders are responsible for assessing and managing cybersecurity risks. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. The UScellular environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.


text: The full Board of Directors engages in oversight of UScellular's cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and UScellular's assessment of cybersecurity threats and mitigation plans. The UScellular Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, at least on an annual basis.


text: The UScellular information security program is based on a defense-in-depth approach and aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Security control and maturity assessments are conducted periodically leveraging this standard. UScellular also leverages internal and external auditors and consultants to perform independent assessments and tests of security controls. The assessment results are used to drive continuous improvement in the UScellular cybersecurity control environment, as well as to manage potential data security risks of third-party service providers.


text: UScellular identifies risks across the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. Risks related to third-party providers who have access to UScellular data and systems are identified, assessed and managed through a formal third-party risk assessment process. Third-parties who access sensitive company or customer information are contractually obligated to meet specific privacy and security requirements. The UScellular security operations program includes active monitoring of the internal data environment and regular assessment of the environments of third-party service providers who manage sensitive data. In addition, UScellular security leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack and further test potential risks. Identified risks are evaluated against a risk classification framework to direct remediation, mitigation and management efforts based on severity. Cybersecurity risks are integrated into the UScellular Enterprise Risk Management (ERM) program with updates provided on a quarterly basis.


text: The Senior Vice President of Information Technology is responsible for assessing and managing cybersecurity risks. He has over twenty years of experience at the company, encompassing network engineering, information technology and cyber security. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. As part of their accountability for incident response, significant incidents are communicated to an internal committee including the Chief Financial Officer and general counsel to assess their materiality and if materiality is confirmed it is reported by the defined process. To date UScellular has not identified nor become aware of any cybersecurity incidents that individually or in aggregate have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.


text: The full Board of Directors engages in oversight of UScellular's cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and UScellular's assessment of cybersecurity threats and mitigation plans. The Senior Vice President of Information Technology provides the full Board of Directors an annual update and discussion of the cybersecurity program. The UScellular Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. The Audit Committee meets with the Senior Vice President of Information Technology at least two times per year. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, typically on an annual basis.


text: EOG relies on information technology systems across its business. As its reliance on data and information technology systems has increased, EOG has continued to evolve and modify its cybersecurity processes and strategy and related governance and oversight practices as well as enhance the expertise of its cybersecurity team.

companyName: EOG RESOURCES INC

ticker: EOG


text: Cyber Risk Management & Strategy As part of its overall risk management system, EOG regularly assesses its processes and practices for managing and mitigating cybersecurity risks and determines whether such risks are being effectively managed and mitigated.


text: EOG has implemented and invested in multiple technologies, controls, and procedures designed to protect its information systems and related infrastructure; identify, assess and remediate vulnerabilities; and monitor and mitigate the risk of data loss and other cybersecurity threats and intrusions.


text: EOG focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates EOG's expectations of employees and contractors with respect to cybersecurity matters via EOG's Codes of Business Conduct and Ethics.


text: EOG's dedicated, in-house cybersecurity team, which is responsible for EOG's cybersecurity strategy and planning, oversees such efforts, with assistance from external threat analysts, consultants and service providers. As part of these efforts, such team seeks to identify potential cyber vulnerabilities and opportunities for improvement and then evaluates and implements different cybersecurity technologies to address any identified vulnerabilities and opportunities.


text: In addition, EOG's internal audit function, in conjunction with third-party experts, play a key role in reviewing and assessing EOG's cybersecurity technologies, controls and procedures, including conducting penetration testing and vulnerability assessments.


text: In the event of an incident, EOG has a designated response team and written response plan in place with predefined escalation and response procedures. EOG also has processes in place to monitor the cybersecurity risk exposure and security practices of key service providers to assess their cyber preparedness.


text: While such technologies, controls, and procedures cannot entirely eliminate cybersecurity threats, EOG believes the risks from cybersecurity threats (including as a result of previous cybersecurity incidents) have been effectively managed and contained, and have not materially affected, and are not reasonably likely to materially affect, EOG and its business strategy, results of operations or financial condition. See ITEM 1A, Risk Factors, for related discussion.


text: As technology and potential cybersecurity threats evolve, EOG intends to continue to adapt and enhance its cybersecurity controls, procedures, and protections.


text: Cyber Expertise & Experience As discussed above, EOG's cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. EOG's in-house professionals and external threat analysts possess various cybersecurity certifications.


text: EOG's cybersecurity team is led by EOG's group director, information systems and senior manager, information systems security, who each have over six years of experience overseeing EOG's cybersecurity processes and strategy.


text: Cyber Governance & Oversight EOG's cybersecurity team reports to EOG's Senior Vice President and Chief Information and Technology Officer, who has served as EOG's Chief Technology Officer since 2017 and as EOG's Chief Information Officer for over 25 years.


text: EOG's cybersecurity team leadership, Senior Vice President and Chief Information and Technology Officer and other members of senior management regularly report to EOG's Audit Committee and Board of Directors (Board) regarding cybersecurity matters, including the assessments performed regarding EOG's cybersecurity technologies, controls and procedures.


text: As part of its risk oversight responsibility and pursuant to its charter, the Audit Committee, in consultation with the Board and the Board's other committees, oversees our policies, strategies, and initiatives for mitigating cybersecurity and information technology risks.


text: EOG has invested in and implemented multiple technologies, controls, and procedures designed to protect its information systems and related infrastructure; identify, assess and remediate vulnerabilities; and monitor and mitigate the risk of data loss and other cybersecurity threats and intrusions.


text: In addition, EOG's internal audit team, in conjunction with third-party experts, plays an important role in reviewing and assessing EOG's cybersecurity technologies, controls and procedures, including conducting penetration testing and vulnerability assessments.


text: EOG's cybersecurity team is led by EOG's group director, information systems and senior manager, information systems security, who each have over seven years of experience overseeing EOG's cybersecurity processes and strategy.


text: EOG's cybersecurity team leadership, Senior Vice President and Chief Information and Technology Officer and other members of senior management are responsible for the day-to-day management of cybersecurity risks and cybersecurity leadership. Such senior management team regularly reports to EOG's Audit Committee and Board of Directors (Board) regarding cybersecurity matters, including the assessments performed regarding EOG's cybersecurity technologies, controls and procedures.


text: As part of its risk oversight responsibility and pursuant to its charter, the Audit Committee, in consultation with the Board and the Board's other committees, oversees EOG's policies, strategies, and initiatives for mitigating cybersecurity and information technology risks.


text: Risk Management and Strategy We have established processes and policies for assessing, identifying and managing material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework with our processes focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. We conduct tabletop exercises with outside consultants at least annually to test our processes and policies and use feedback from those exercises to improve our processes. Our senior management and members of the Audit Committee of our Board of Directors participate in those exercises. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face, see Item 1A Risk Factors – Information technology failures or data security breaches could harm our business and result in substantial costs.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. Our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Information Officers (CIO) and Chief Information Security Officers (CISO), provides quarterly updates to our Audit Committee and an annual update to our Board of Directors with respect to cybersecurity matters.


text: Aspects of the information systems of our Homebuilding operations and our Financial Services operations are separate and distinct, and therefore each operation has a separate CIO and CISO. The CIOs are responsible for managing their respective CISO and ensuring their information security team is assessing and managing cybersecurity risks in accordance with our processes and procedures. Each of our CIOs has over 20 years' experience managing enterprise information technology systems. The CISO of our Homebuilding operations is a certified information security manager as certified by the Information Systems Audit and Control Association (ISACA). Pursuant to our Cybersecurity Incident Response Plan (CIRP), when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident and outlines the processes for containment, eradication, recovery and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident. We are not aware of any material cybersecurity incidents in the last three years.


text: Risk Management and Strategy We have established processes and policies for assessing, identifying, and managing material risks posed by cybersecurity threats. Our processes and policies are designed to be based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework with our processes focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are also frequently working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. We conduct tabletop simulation exercises with outside consultants at least annually to test our processes and policies and use feedback from those exercises to improve our processes. Our senior management team members are active participants in each of those exercises, and members of the Audit Committee of our Board of Directors have participated in some of those exercises as well. Our processes and policies include the identification of those third-party relationships that have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity matters as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face to our business strategy, results of operations and financial condition, see Item 1A Risk Factors – Information technology failures or data security breaches could harm our business and result in substantial costs.


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. Our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), provides quarterly updates to our Audit Committee and an update to our Board of Directors at least annually with respect to cybersecurity matters. Our Audit Committee regularly reviews and discusses with management the strategies, processes, procedures, and controls pertaining to the management of the Company's information technology operations, including cybersecurity risks. This enables management to provide oversight, set risk tolerances, and support a comprehensive cybersecurity program that manages material cybersecurity risks to the Company.


text: Aspects of the information systems of our Homebuilding operations and our Financial Services operations are separate and distinct, and, prior to the third quarter of 2024, each operation had a separate CIO and CISO. In August of 2024, our information technology operations were centralized under a single CIO and a single CISO, each with enterprise-wide responsibilities. Our CISO reports to our CIO and is responsible for managing the information security team and working to ensure the team is assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CIO has over 30 years' experience managing enterprise information technology systems. Our CISO has over 25 years' experience working in information technology and cybersecurity roles and is a certified information security manager as certified by the Information Systems Audit and Control Association (ISACA). Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident, and outlines the processes for containment, eradication, recovery, and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident. We are not aware of any material cybersecurity incidents in the last three years.


text: Clean Harbors recognizes the critical importance of developing, implementing and maintaining cybersecurity measures to safeguard our information technology. The Company has integrated cybersecurity risk management into our overall risk management framework to collectively assess and respond to operational, financial and cybersecurity risks.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Board of Director Oversight The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board, led by the Executive Chairman Alan McKim, who is also the Chief Technology Officer of the Company, has primary oversight responsibilities for cybersecurity risks and therefore has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: During 2023, the Board of Directors established a special subcommittee with the goal of reviewing the Company's overall cybersecurity risk and response landscape. The special Cybersecurity subcommittee is comprised of board members with diverse expertise including risk management, technology and finance, with two members holding Cybersecurity Oversight Certificates issued by the National Association of Corporate Directors and Carnegie Mellon University.


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide comprehensive briefings throughout the year to both the Cybersecurity subcommittee, which meets quarterly, and to the Board of Directors as well. The briefings include the current landscape of cybersecurity risks and emerging threats, relevant Company infrastructure and tools employed to address these risk and threats, status of ongoing initiatives, incident reports and learnings and compliance with regulatory requirements and industry standards.


text: Management's Oversight and Responsibilities Reporting to the CIO, Cybersecurity at Clean Harbors is managed by the Chief Information Security Officer who is a Certified Informational Systems Security Professional. The CISO leads the Clean Harbors' cybersecurity response program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework providing a collaborative, balanced risk based approach to securing and defending the Company.


text: The CISO leverages both open source and private threat intelligence sources to remain current about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes and technologies for regular monitoring of our information systems. Third party cybersecurity advisory services are employed to consult on, monitor, respond and/or assess our IT landscape and cybersecurity response.


text: The CISO is also responsible for the ongoing cybersecurity awareness, training and education of the employees of Clean Harbors and any other parties that may interact with the Company's information technology systems. Awareness activities include cybersecurity training, simulated exercises, cross functional tabletop exercises and internal communication updates. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan which has been communicated to the IT and operational organization. This plan includes immediate actions to mitigate the impact, solutions to enable the restoration of business critical technology and long-term strategies for remediation and prevention of future incidents.


text: Risks from Cybersecurity Threats The Company has not encountered cybersecurity challenges that have materially impacted our operations or financial results. The Company has included the relevant potential risks from cybersecurity threats as part of the Company's Risk Factors in Item 1A herein.


text: We have a special subcommittee of the Board of Directors with the goal of reviewing the Company's overall cybersecurity risk and response landscape. The special Cybersecurity subcommittee is comprised of board members with diverse expertise including risk management, technology and finance, with two members holding Cybersecurity Oversight Certificates issued by the National Association of Corporate Directors and Carnegie Mellon University.


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide comprehensive briefings throughout the year to the Cybersecurity subcommittee, which meets quarterly. The chair of the Cybersecurity subcommittee provides updates on the subcommittee's activities to the Board of Directors and, from time to time as warranted, the CISO and CIO will present to the full Board of Directors as well. The briefings include the current landscape of cybersecurity risks and emerging threats, relevant Company infrastructure and tools employed to address these risk and threats, status of ongoing initiatives, incident reports and learnings and compliance with regulatory requirements and industry standards.


text: Management's Oversight and Responsibilities Reporting to the CIO, the CISO manages Cybersecurity at Clean Harbors and is a Certified Informational Systems Security Professional. The CISO leads the Clean Harbors' cybersecurity response program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework providing a collaborative, balanced risk based approach to securing and defending the Company.


text: The CISO leverages open source and private threat intelligence sources to remain current about the latest developments in cybersecurity, including potential threats and risk management techniques. The CISO implements and oversees processes and technologies for regular monitoring of our information systems. Third party cybersecurity advisory services are employed to consult on, monitor, respond and/or assess our IT landscape and cybersecurity response.


text: Risk Management and Strategy We have established processes for identifying, assessing and managing material risks from cybersecurity threats associated with our key information technology systems. These processes have been integrated into our overall risk management strategies, as overseen by our Board of Directors, primarily through the board's Corporate Risk Committee and Audit Committee. These processes also include identifying and overseeing risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we conduct employee training on information security topics designed to address phishing and e-mail security, password security and data-handling security. We use e-mail security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing e-mails and avoid IT system interruptions. From time to time, we engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate cybersecurity threats and incidents as appropriate. Additionally, our Enterprise Risk Management ("ERM") team analyzes cybersecurity risks, emerging industry trends and identification of mitigation, as part of a holistic analysis of risks across CHS.

companyName: CHS INC

ticker: CHSCP


text: Under the oversight of the Corporate Risk Committee of our Board of Directors, the chief information officer ("CIO") and chief information security officer ("CISO") are primarily responsible for assessment and management of material cybersecurity risks, with the CIO being responsible for strategic direction and management of information technology systems and the CISO being responsible for security of such systems, as described further below. The CIO has more than 30 years of experience with global technology organizations across multiple industries. The CISO has more than 20 years of experience in information security, risk management and compliance and is a certified information systems security professional. The CIO and CISO are also supported by an incident response team ("IRT") comprised of selected members of senior management and responsible for providing cross-functional support and response facilitation for cybersecurity incidents.


text: Our CISO oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats, including aligning programs with industry standards, conducting tabletop exercises, providing education/training and taking other preventive measures. Our CISO coordinates with legal counsel and third party experts to assess and manage material risks from cybersecurity threats. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. Our CISO or a delegate informs the IRT of cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CISO, in collaboration with legal counsel, is primarily responsible for advising our chief executive officer ("CEO") and chief financial officer ("CFO") regarding cybersecurity disclosures in public filings. The CISO also notifies the Audit Committee chair of any material cybersecurity incident.


text: As of the date of this Annual Report on Form 10-K, we have not detected any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition. For further discussion of the risks associated with cybersecurity incidents, refer to Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Board of Directors The Corporate Risk Committee of our Board of Directors oversees our information technology systems, including information security, compliance and privacy. Additionally, the Audit Committee of our Board of Directors oversees adequacy and effectiveness of our controls and procedures, including those designed to assess, identify and manage material risks from cybersecurity threats and incidents. Further, at least once per quarter, our CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee, and updates are provided to our Board of Directors at regular board meetings. The CIO also provides updates annually or more frequently as appropriate to our Board of Directors. Our ERM team reports annually on the company's risks to our Board of Directors, which includes progress related to mitigation activities and risk conditions.


text: Risk Management and Strategy We have established processes for identifying, assessing and managing material risks from cybersecurity threats associated with our key information technology systems. These processes have been integrated into our overall risk management strategies, as overseen by our Board of Directors, primarily through the Corporate Risk Committee and Audit Committee. These processes also include identifying and overseeing risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we conduct employee training on information security topics designed to address phishing and e-mail security, password security and data-handling security. We use e-mail security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing e-mails and avoid IT system interruptions. From time to time, we engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate cybersecurity threats and incidents as appropriate. Additionally, our Enterprise Risk Management ("ERM") team analyzes cybersecurity risks, emerging industry trends and identification of mitigation, as part of a holistic analysis of risks across CHS.


text: Our CISO oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats, including aligning programs with industry standards, conducting tabletop exercises, providing education/training and taking other preventive measures. Our CISO coordinates with legal counsel and third-party experts to assess and manage material risks from cybersecurity threats. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. Our CISO or a delegate informs the IRT of cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CISO, in collaboration with legal counsel, is primarily responsible for advising our chief executive officer ("CEO") and chief financial officer ("CFO") regarding cybersecurity disclosures in public filings. The CISO also notifies the Audit Committee chair of any material cybersecurity incident.


text: Board of Directors The Corporate Risk Committee of our Board of Directors oversees our information technology systems, including information security, compliance and privacy. Additionally, the Audit Committee of our Board of Directors oversees adequacy and effectiveness of our controls and procedures, including those designed to assess, identify and manage material risks from cybersecurity threats and incidents. Further, at least bi-annually, our CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee, and updates are provided to our Board of Directors at regular board meetings. The CIO also provides updates annually or more frequently as appropriate to our Board of Directors. Our ERM team reports annually on the company's risks to our Board of Directors, which includes progress related to mitigation activities and risk conditions.


text: Cybersecurity risk management and strategy Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology ("NIST"), the Center for Internet Security ("CIS"), the Computer Objectives for Information and related Technology ("COBIT"), and the International Organization for Standardization ("ISO"). We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: AAON, INC.

ticker: AAON


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks as needed. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and internal risk management. Our information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our chief information officer has primary oversight of material risks from cybersecurity threats. Our chief information officer has more than 25 years of experience across various engineering, business and management roles, including leading the development and implementation of information technology strategies and roadmaps for manufacturing automation.


text: Our chief information officer assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our chief information officer meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the chief financial officer reviews with the audit committee at least annually our risk management program, which includes cybersecurity risks, and is also reported to the board.


text: Cybersecurity risk management and strategy We maintain various information security processes designed to identify and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and data, including personal data, intellectual property and confidential information that is proprietary, strategic or competitive in nature. Our cybersecurity function includes representatives from information technology, engineering, information security, legal, impacted business units or products and other departments as applicable and help identify, assess and manage the Company's cybersecurity threats and risks.


text: The management team is responsible for identifying, assessing and managing cybersecurity risks by monitoring and evaluating potential threats using various methods including, for example, manual and automated tools such as vulnerability scans, penetration tests and system configuration reviews; conducting risk assessments and internal and external audits; and conducting tabletop incident response exercises. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage risks from cybersecurity threats to our systems, including, for example: (1) having an information security incident response plan; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls in alignment with industry standard security frameworks like National Institute of Standards and Technology ("NIST") and Center for Internet Security ("CIS"); (5) encrypting and segregating data, having network security controls, access controls, monitoring systems, managing assets and conducting penetration testing; and (6) maintaining cybersecurity insurance.


text: Our assessment and management of risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program in concert with the audit committee and board of directors; (2) our information security team works with our management team in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our information security and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee for further communication as required, to evaluate our overall enterprise risk. We use third-party service providers to assist us in identifying potential risks from cybersecurity threats. For example, these service providers include professional services firms, managed cybersecurity service providers, penetration testing firms and forensic investigators. We have a vendor management process designed to manage cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits.


text: Governance of cybersecurity risk management The Board of Directors has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. The Company officer with oversight of Information Technology ("IT") has primary oversight of material risks from cybersecurity threats. Through November 2024, our Chief Information Officer was responsible for IT and had more than 25 years of experience across various engineering, business and management roles, including leading the development and implementation of information technology strategies and roadmaps for manufacturing automation. After the departure of our Chief Information Officer, our Vice President of Administration has responsibility and oversight for IT.


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to Management, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our information security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The incident response team works with the Company's management team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's information security incident response plan includes reporting to the board of directors for certain cybersecurity incidents.


text: Management meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the Chief Financial Officer reviews with the audit committee at least annually our risk management program, which includes cybersecurity risks and is also reported to the board.


text: Information security, which includes cybersecurity, is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data.

companyName: SANDY SPRING BANCORP INC


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Information Security Officer is responsible for information security and cybersecurity risk management. He has over 20 years of financial services related experience in cybersecurity program strategy, security architecture and security team leadership. Our Chief Technology Officer, among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the Chief Information Security Officer. He has over 25 years of experience building and leading technical organizations of various sizes, including in the banking industry.


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. The program is overseen and executed by a team of experienced, certified cybersecurity professionals. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively.


text: We use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks with our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing, and are tracked and reported.


text: We have contracted with various service providers (vendors) who provide a broad range of services, including core banking, communications, collaboration and infrastructure services. We have established a vendor management policy to establish the principles, framework, and guidance for the effective review, engagement, monitoring, and oversight of vendors to ensure that we adequately manage operational, strategic, reputational, and other related risks inherent in outsourcing of services or operations. We manage the cybersecurity risks posed by our use of third-party service providers by conducting periodic risk assessments.


text: The cybersecurity operations team is responsible for cyber threat detection, investigation and response. We leverage a managed security service provider to monitor key system and network activity on a 24/7/365 basis and to detect and alert the cyber security operations team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Technology Risk Committee, which is a standing subcommittee of the Operational Risk Committee, is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Risk Committee is chaired by our Chief Technology Officer and members include our Chief Information Officer, Chief Information Security Officer, and administrators of key business systems. The Technology Risk Committee reports regularly to the Operational Risk Committee, which reports to the Executive Risk Committee, which includes our Chief Executive Officer and other executive officers. Through this committee reporting structure, management is informed about and monitors the information security program and its management of cybersecurity risks and incidents.


text: The Board of Directors, through the efforts of its Risk Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. As part of its oversight of operational risk, the Risk Committee is responsible for the oversight of information security and cybersecurity risk management. Our Chief Information Security Officer regularly reports to the Risk Committee on security events, testing, training, audits, new system assessments and the identification and remediation of cybersecurity risks. These reports also include topics such as the threat environment and vulnerability assessments, results of penetration testing, results of key cyber risk indicators and performance metrics, and our efforts to detect, prevent and respond to internal and external critical threats. The Risk Committee receives periodic updates on information security risk, the maturity of our information security program, and related investments and results. On an annual basis, the Risk Committee reviews and approves our information security program and information security policy.


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. The program is overseen and executed by a team of experienced, certified cybersecurity professionals. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively. Annually, and at onboarding, our employees are required to take information security training. Employees also receive periodic education announcements on cybersecurity related topics to help them in their role in protecting the Bank and our clients from cybersecurity threats. Employees are tested on a monthly basis with simulated phishing emails and if necessary additional training is assigned.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Technology Risk Committee, which is a standing subcommittee of the Operational Risk Committee, is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Risk Committee is chaired by our Chief Technology Officer and members include our Chief Information Officer, Chief Information Security Officer, and administrators of key business systems. The Technology Risk Committee reports regularly to the Operational Risk Committee, which reports to the Executive Risk Committee, which includes our Chief Executive Officer and other executive officers. Through this committee reporting structure, management is informed about and monitors the information security program and its management of cybersecurity risks and incidents. When a cybersecurity incident is detected, we follow a cybersecurity incident response plan and associated procedures as we mitigate, respond and recover from the incident. Management assesses the materiality of a cybersecurity incident to our business and determines the communications that are made to internal and external parties at the appropriate times. When a cybersecurity incident is detected, we follow a cybersecurity incident response plan and associated procedures as we mitigate, respond and recover from the incident. Management and, if required, external subject matter experts are directly involved in assessing the materiality of a cyber security incident to our business, and determine the communications that are made to internal and external parties at the appropriate times. The cybersecurity incident response plan is tested annually using a simulation exercise involving representatives from organizations across the Bank, including executive management.


text: The Board of Directors, through the efforts of its Risk Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. As part of its oversight of operational risk, the Risk Committee is responsible for the oversight of information security and cybersecurity risk management. Our Chief Information Security Officer regularly reports to the Risk Committee on security events and incidents, testing, training, audits, new system assessments and the identification and remediation of cybersecurity risks. These reports also include topics such as the threat environment and vulnerability assessments, results of penetration testing, results of key cyber risk indicators and performance metrics, and our efforts to detect, prevent and respond to internal and external critical threats. The Risk Committee receives periodic updates on information security risk, the maturity of our information security program, and related investments and results. On an annual basis, the Risk Committee reviews and approves our information security program and information security policy.


text: Cyber Risk Management and Strategy We rely on digital technology to conduct our business operations and engage with our clients, business partners and employees. The technology that we, our clients, business partners and employees rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising the due care necessary to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: Through a combination of security, risk and compliance resources, AB implements Information Security through a dedicated Information Security Program ("ISP") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.


text: Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another later of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. Our security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments and our internal audit function includes certain cyber risk audits as part of its overall risk audit. We review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of our ISP, we also perform cyber risk assessments on our critical and material third party vendors during onboarding, then periodically thereafter.


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including those discussed in Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. the full Board is updated on an as needed basis. In the event of an immediate cyber threat to our business operations, our ISP would involve our General Counsel, who would promptly notify the Chairperson of the Audit and Risk Committee, as to the nature, timing and extent of the threat and our applicable contingency plans would go into effect. Our CRO, in collaboration with our CISO, is responsible for notifying the Audit and Risk Committee of world events or of other significant external events that may pose cybersecurity threats or material risks to our business continuity.


text: While our Board provides oversight of our cybersecurity risk environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. Our CISO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our ISP within the organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. Our CISO has years of applied experience in actively managing cybersecurity and information security programs for large global publicly traded companies with complex and evolving information systems. Management oversight of our ISP is provided by various governance committees including the Operational Risk Oversight Committee, the Information Security Risk Oversight Subcommittee and the Financial Crimes Control Oversight Subcommittee.


text: Cyber Risk Management and Strategy Through a combination of security, risk and compliance resources, AB implements information security through a dedicated Information Security Program ("ISP ") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.


text: AllianceBernstein Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The defense-in-depth strategy manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) periodically assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) essential business functions remaining available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers, as appropriate, impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments to identify, assess, manage, and as appropriate, mitigate and respond to cybersecurity risks, and our internal audit function includes certain cyber risk audits as part of its overall risk audit. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of our ISP, we also perform cyber risk assessments on our third party vendors where we deem appropriate based on our risk assessment of such vendors, then periodically thereafter.


text: As of the date of this report, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations. However, there can be no assurance that the Company will not be materially affected by such risks. See Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks for a discussion of cybersecurity risks.


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. The full Board is updated on an as needed basis. In addition, management updates the Audit and Risk Committee, as appropriate, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: Risk Management and Strategy Cybersecurity risk was identified as a significant enterprise risk based on the results of our most recent enterprise risk assessment. As a significant enterprise risk, we have worked to identify the underlying drivers of cybersecurity risk, identify the activities in place to manage it and assess its residual risk level. We have developed and implemented comprehensive strategies and processes to assess, identify, manage and mitigate cybersecurity risks, aligning with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). These processes include: • implementing security event monitoring, incident response processes, access management controls, vulnerability identification and remediation, third-party risk monitoring and user awareness and training; • providing regular security training and awareness content for all associates, with mandatory training for new hires; • maintaining cybersecurity risk insurance to mitigate potential breach-related costs; • engaging consultants to perform periodic external assessments using industry-recognized frameworks like NIST CSF; and • monitoring program maturity through periodic reviews against the Capability Maturity Model Integration framework.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Risk Assessments We identify and categorize existing third-party service providers based on criticality to our operations and prioritize those that pose the highest risks. We leverage a third-party risk management solution to facilitate our risk assessment process for new third parties which includes interviews and questionnaires with internal business contacts and contacts from the third party to perform an inherent risk assessment. We determine applicable security controls based on the inherent risk level to drive the residual risk score to an acceptable level where possible. The goal of the risk assessment process is to evaluate the risks associated with each third party, including operational, financial, legal and reputational risks.


text: Ongoing Monitoring Based on the residual risk score of a third party, we conduct assessments on a periodic basis to help ensure that we maintain current information on our vendors. We leverage an external third-party monitoring service to conduct continuous monitoring of our critical vendors to provide additional visibility and response efforts and work directly with vendors to remediate identified vulnerabilities. Finally, we review contracts that outline risk management responsibilities, compliance requirements, data protection and incident management protocols.


text: Incident Management We have developed an incident response plan that establishes a process for addressing issues arising from third-party relationships and communication channels for reporting and managing incidents involving third parties.


text: Documentation and Reporting We maintain detailed records of our third-party assessments and any information or documentation that is provided during the assessment process. We regularly review and report on third-party risk management activities and any significant issues to senior management and/or our Audit Committee.


text: External Resources; Associate Training and Awareness We have developed a comprehensive information security program that relies on support from third-party experts and an internal training and awareness program aligned with industry standards and best practices.


text: Given the complex and evolving nature of cybersecurity threats, we engage third-party advisors and consultants to assist us in developing and maintaining effective cybersecurity risk management processes. Partnering with these third parties allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, we work with third parties to regularly conduct simulated attack exercises to identify additional needs for training and overall program refinement.


text: Internally, our training and awareness program creates multi-layered defenses by empowering associates with knowledge and tools to recognize and respond to security risks. Through role-specific and comprehensive training, we seek to maintain a workforce that actively contributes to the achievement of our cybersecurity goals. Key components of our training program include: • Onboarding Training — All new associates participate in an initial cybersecurity training module at onboarding. This training covers the Company's security policies, data protection standards and foundational security practices helping to ensure that new hires are equipped to meet the Company's expectations pertaining to its security protocols. • Articles — We publish articles on our intranet site for all associates to easily access. These articles highlight emerging threats, industry trends and actionable tips to help associates enhance their personal and professional security posture. We target critical topics such as ransomware, social engineering, data management and the latest threats and best practices. • Phishing Simulations — Our phishing awareness program includes continuous phishing simulations conducted on a routine basis. This program helps associates develop the skills to effectively identify and mitigate phishing attempts. Associates who fail a threshold number of simulations during a calendar year are required to undergo additional training. • Cybersecurity Awareness Month Activities — We have implemented interactive, virtual and on-site awareness activities during Cybersecurity Awareness Month in October. These activities include phishing simulations, articles, lunch and learns and gamification to serve as refreshers on critical security concepts and reinforce our commitment to maintaining a security-conscious culture.


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated oversight of cybersecurity risks to our Audit Committee, including overseeing the actions management has taken to identify, monitor and control such exposure. On a quarterly basis, our Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of our continued investment in developing our overall enterprise risk management program, our Audit Committee receives reports and presentations from management which address a range of cybersecurity topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and technological trends. Our Chief Information Security Officer ("CISO") and information security management team report to our Audit Committee on a quarterly basis on cybersecurity matters.


text: At the management level, our CISO leads the team responsible for implementing, monitoring and maintaining information security, including data protection practices across our business. Our CISO receives reports on cybersecurity threats from both our internal personnel and external partners on a regular basis. Our Chief Operating Officer and Chief Financial Officer receive regular reports from our CISO on the information security program and measures implemented by the Company to identify and mitigate cybersecurity risks. Our CISO works closely with our legal team to ensure compliance with legal and regulatory requirements related to cybersecurity. Our CISO has over a decade of cybersecurity and risk management experience and holds CISA, CISM and CISSP certifications as well as a bachelor's degree in Business Information Systems.


text: Cybersecurity Threats and Incidents To date, cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. During fiscal 2025, fiscal 2024 and fiscal 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations and/or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced undetected cybersecurity incidents. For additional details regarding the risks the Company faces from cybersecurity threats, see "ITEM 1A. RISK FACTORS — Risks Related to Our Business — Our operations, financial condition or reputation may be impaired if our information or operational technology systems fail to perform adequately or if we are the subject of a data breach or cyber attack" in this Form 10-K.


text: We use, store and process data for and about our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Risk Management Oversight and Governance Under the ultimate direction of our Chief Executive Officer and executive management team, our Information Security Core Committee has primary responsibility for overseeing our management of cybersecurity risks. This committee is chaired by our Chief Information Security Officer, or CISO, who reports directly to our Chief Risk Officer. Other members of the committee include representatives from Information Technology, Operations, Privacy, Compliance, BSA, Audit. Business Continuity, Vendor Management, Human Resources, Physical Security, Unified Fraud, Retail, Wealth Management, Lending, and Enterprise Risk Management.


text: Our CISO, working with his team and the Information Security Core Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. He has more than 25 years of experience in building and leading information security teams and has worked at a technology start-up and a large, publicly-traded financial institution before joining the Company. His experience as a technology engineer has prepared him to lead a variety of teams, both large and small, design, implement and execute executive cyber and information security controls. He studied Computer Science at the University of Virginia and holds a Certified Information Systems Security Professional ("CISSP") certification. In addition to frequent electronic communication, the committee meets monthly and more frequently, as circumstances warrant, to discuss and monitor prevention, detection, mitigation and remediation of risks from cybersecurity threats. When appropriate, meetings will also include our Chief Risk Officer, Chief Financial Officer, General Counsel and members of our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee is responsible for reviewing reports on data management and security initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.


text: Our CISO meets quarterly with the Enterprise Risk Management Committee of the Board of Directors to discuss management's ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation and current developments in the cybersecurity landscape. This presentation is shared with the full Board of Directors to enable discussion of cybersecurity risk management at the full board level.


text: Processes for the Identification of Cybersecurity Threats Under the guidance of the Information Security Core Committee and the CISO, we have adopted a cybersecurity risk management program that addresses, among other areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; and • Given that landscape, how to manage cybersecurity risks.


text: Our risk assessment and mitigation program is centered on three key components: • Identification of risks, which involves input from different groups across the Company; • Evaluation of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business and cost/benefit analysis to fully address; and • Execution – establishment of a program to address.


text: Our information security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the Company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The information security team has processes designed to keep the Company apprised of the different threats in the cybersecurity landscape – this includes interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending security conferences. The team also regularly monitors our internal network and out customer-facing network to identify security risks.


text: Our Internal Audit function updates the Enterprise Risk Management Committee of our Board of Directors on a quarterly basis about the Company's enterprise risk management program. These reports are the culmination of a process that involves discussions with leaders across the Company and incorporates a multitude of enterprise risk factors, including cybersecurity threats. The Enterprise Risk Management Committee Chair, in turn, reports to the full Board of Directors a summary of the enterprise risk management presentation.