text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: PARSONS CORP

ticker: PSN


text: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

secItem: Item 1C


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes; (2) our security processes; and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions, as we have described in the Risk Factors section of this Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit and Risk Committee. The Audit and Risk Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security Officer reports to the Chief Technology Officer and works closely with the Chief Legal Officer to ensure that all disclosure or reporting requirements are satisfied if an incident were to occur. The Chief Security Officer leads Parsons' overall cybersecurity function and provides quarterly reports to the Audit and Risk Committee on our cybersecurity risks, including briefings on our cybersecurity risk management program and cybersecurity incidents. The Audit and Risk Committee also receives periodic presentations on relevant cybersecurity topics as part of the Committee and the Board's continuing education on topics that impact public companies.


text: Our Chief Security Officer supervises efforts to prevent, detect, mitigation and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment. Our Chief Security Officer is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for leading our overall cybersecurity risks management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Security Officer has significant global experience in managing and leading IT and cybersecurity teams and holds cybersecurity certifications from leading cybersecurity training and research institutes.


text: Risk Management and Strategy As is the case for similar companies of our size and industry, we may be the target of cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: We engage certain external parties, including cybersecurity and privacy firms, to enhance our cybersecurity oversight and risk reduction abilities. We also perform an annual cybersecurity assessment designed to help align our cybersecurity program with industry best practices. In addition, we regularly consult with industry groups, peer organizations, and external executives to assess the cybersecurity threat landscape throughout the year.


text: Our cybersecurity policies, standards, and procedures include cyber and data breach response plans benchmarked against multiple cybersecurity risk frameworks. Our incident response plan is designed to help coordinate the response to and recovery from cybersecurity incidents and includes processes to identify, investigate, triage, assess the severity of, escalate, contain, and remediate incidents and comply with applicable legal or regulatory obligations. We also regularly perform technical reviews of our systems to help secure our digital environment and confirm software patches are appropriately up-to-date.


text: To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have implemented a third-party risk management program designed to help protect against information misuse and assess the information technology security measures of potential third parties and business partners. We perform a third-party risk assessment before starting a relationship with certain service providers and utilize a third-party risk intelligence program to monitor the activity of critical vendors following engagement. In addition, we maintain cyber insurance coverage as part of our overall risk mitigation strategy. This cyber insurance coverage may not be sufficient to cover against all claims.


text: We do not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. Beginning in 2024, the Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.


text: We also have a cybersecurity steering committee responsible for assisting with our overall day-to-day cybersecurity responsibilities and implementing our cybersecurity programs. The cybersecurity steering committee is currently comprised of members of our digital and enterprise capabilities team and is chaired by our executive director of cybersecurity. Among other things, the cybersecurity steering committee: • reviews our internal controls to help protect our information assets; • assists with developing practices, procedures, and controls designed to identify, assess, and manage critical cybersecurity programs and risks; and • works to align our risk governance structure, including policies and procedures, with our business objectives.


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.


text: In addition, to help prevent and detect cybersecurity threats, we provide all employees, including part-time and temporary employees, with monthly cybersecurity and privacy training, which covers timely and relevant cybersecurity topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security.


text: Risk Management & Strategy Innospec has strategically integrated cyber security risk management into its broader risk management framework to promote a company-wide culture of cyber security risk management. This integration ensures that cyber security considerations are an integral part of our decision-making processes at every level. For example, training on cyber security risks was required of all Innospec directors and employees who have access to our information technology resources. Our risk management team works closely with our Information Technology ("IT") leadership to continuously evaluate and address cyber security risks in alignment with our business objectives and operational needs.

companyName: INNOSPEC INC.

ticker: IOSP


text: Innospec's IT leadership team is responsible for assessing, identifying and managing the inherent and residual risks associated with cyber security threats across our IT and Operational Technology landscape. IT leadership periodically reviews the Company's external threats, portfolio, and external services, and will update its risk register accordingly.


text: IT leadership will, when required by either executive management or the Board, engage third-party reviews of our overall cyber security compliance using The National Institute of Technology ("NIST") framework. IT leadership will also periodically engage specialist security contractors to test the Company's resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.


text: Innospec utilizes an external service to provide ongoing analysis of the security related to our critical third-party service providers for IT operations and business IT services. Innospec will use the information provided by this external service as part of its IT vendor selection criteria and for ongoing third-party risk management.


text: Innospec's cyber security is underpinned by a third-party specialist that monitors critical systems and end-user devices for cyber-attacks. In the first instance, cyber-attacks are brought to the attention of the IT leadership for evaluation and remediation before further escalation to the CEO and CFO is considered.


text: Periodically, our systems are subject to targeted attacks which are intended to interrupt our operations or may lead to the loss, misuse or theft of personal information relating to our employees, suppliers and customers or lead to the loss of Company data, confidential information or our intellectual property.


text: Innospec's Board and its committees provide oversight of the Company's IT, including cyber security, in connection with the Company's efforts to assess and manage the Company's risk exposure. Oversight of risk management, including cyber security risk management is an integral part of Board and committee deliberations throughout the year. Since 2019, the Board has retained NCC Group ("NCC") to perform cyber security reviews. NCC reports its findings directly to the Board. In addition, in early 2020 the Audit Committee retained Deloitte to lead a series of information technology risk evaluations. The evaluation resulted in a three-year audit plan covering Cyber Security, Legacy IT and IT Strategy. The audit plan was approved by the Audit Committee.


text: Innospec's Board has delegated responsibility for the management of the Company's IT to the Company's IT steering committee via the CEO and CFO. The IT steering committee is made up of executive management, business leaders from our reporting segments, the functional heads responsible for our operating systems, IT leadership and is chaired by our Global IT Director. The Company considers that the IT steering committee members have the appropriate qualifications and experience required to enable them to fulfill their responsibilities. The IT steering committee may, as per its agreed terms of reference, escalate any matter it wishes to the Board via either the CEO or CFO.


text: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles across Innospec's IT operations. The Company considers that the IT leadership team is sufficiently experienced and qualified in its role of assessing and managing cyber security risks across the business. IT leadership formally reports through the CEO and CFO to the Board.


text: Innospec's CEO and CFO are involved with and approve the Company's strategy for managing the prevention, detection, mitigation and remediation of cyber security incidents as part of its "IT Security Management System" which includes defined escalation and internal communications processes and responsibilities.


text: IT leadership will, as required, present to the IT steering committee, information regarding any IT risks identified and the mitigation plans to reduce the Company's residual risks. The IT steering committee will be regularly updated as to the occurrence, mitigation and resolution of cyber security incidents. Any cyber security incident that is considered significant in nature will be shared by IT leadership with the IT steering committee in accordance with the agreed communication and escalation processes. The IT steering committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.


text: In the last three fiscal years, management has determined there were no cyber security threats that have materially affected Innospec and that the expenses incurred relating to cyber incidents have been immaterial. The Company is not aware of any threats that are reasonably likely to materially affect its business strategy, results of operations or financial condition for the foreseeable future.


text: IT leadership provides a written report to the Board each quarter and the Global IT Director presents in person at least annually. Those reports and presentations include information on Innospec's cyber security and the related key performance indicators. IT leadership also provides external threat analysis to the Board when new relevant threats are identified as being exploitable and their potential impact on Innospec.


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors and individuals. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Risk Management and Strategy Our enterprise risk management program, which includes cybersecurity risks that are identified through our cybersecurity risk management program, is designed to identify, report, and manage relevant material risks and opportunities.


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our Chief Security Officer ("CSO") and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.


text: We have a cybersecurity risk management program that is managed by a team of full-time cybersecurity professionals that utilizes a variety of tools and techniques to identify and assess material cybersecurity threats, their potential impact and opportunities for mitigation. The industry-standard security frameworks that we apply to our cyber environment include various security and risk assessments, such as internal threat assessments and internal control self-assessments. Because we are aware of the risks associated with third-party providers, we conduct third-party provider security assessments and benchmarking before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. These assessments include evaluation of risk profiles through vendor questionnaires, review of System and Organization Controls attestation reports and monitoring on an ongoing basis by our IT risk management team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.


text: We also have a cybersecurity incident response plan and procedures to manage cybersecurity incidents. These procedures include steps to identify, classify, communicate, contain, eradicate, and recover from a cybersecurity incident. These procedures also include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors.


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 28 years of prior work experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.


text: Through oversight of the cybersecurity risk management program, our CSO is continually informed about the status of the program, including the effectiveness of the process and controls to monitor, prevent, detect, mitigate, and remediate cybersecurity incidents. The CSO is also made aware of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO, in his capacity, regularly informs the Chief Information Officer and other members of our senior management team of all aspects related to cybersecurity risks and incidents.


text: As part of the Company's enterprise risk management, we maintain a cyber risk program with established policies and procedures to detect, prevent, mitigate, and remediate cybersecurity incidents and related risks. The program is led by our Chief Information Security Officer ("CISO"), who has 30 years of experience in information security and is a Certified Information Systems Security Professional. Our CISO reports directly to our Chief Information Officer of Corporate IT, who has over 25 years of experience in all areas of information technology. Our cybersecurity team is comprised of experienced, educated, and certified professionals with decades of experience in cybersecurity leadership roles.

companyName: NOV Inc.

ticker: NOV


text: Our cyber risk management program is based on recognized industry practices and standards in cybersecurity and information technology. These standards include the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001. Security controls are managed using an information security management system ("ISMS"), providing a systematic approach consisting of people, processes, and technology. NOV's ISMS aims to minimize risk and ensure business continuity by proactively limiting the impact of security incidents.


text: Our cybersecurity incident response plan includes an escalation process to senior management, who evaluates various factors related to the cybersecurity incident to assess the impact on the Company and any required disclosures. If a cybersecurity incident was determined to be material by senior management, our Board of Directors would be promptly notified and the incident reported based on applicable legal requirements. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems. We evaluate third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. We conduct continuous vulnerability assessments and continuous penetration testing. Additionally, we undergo internal and external assessments of our processes to identify opportunities for improvement and reduce exposure to cybersecurity incidents.


text: The Company's Board of Directors provides oversight of the Company's cybersecurity program through periodic updates, typically on a quarterly basis. Additionally, on an annual basis, cybersecurity risks are discussed as part of enterprise risk management.


text: We have not experienced any cybersecurity incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. Although we have not experienced any cybersecurity incidents that are individually, or in aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. We recognize the potential impact of cybersecurity risks on our business strategy, results of operations, and financial condition and take proactive measures to mitigate these risks. See Item 1A. "Risk Factors."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include: • Risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, key third-party partners, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for key third-party vendors and suppliers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are subject to cybersecurity risks to operational systems, security systems, or infrastructure owned by Allison or third-party vendors or suppliers" in Part I, Item 1A. of this Annual Report on Form 10-K.


text: Our Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Officer ("CIO") and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for implementing our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team, led by our CISO, is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal cybersecurity team members and external consultants, threat intelligence and other information obtained from public or private sources, and alerts and reports produced by security tools deployed in our information technology environment. Our CISO has over 25 years and our CIO has over 10 years of experience in designing and implementing corporate information technology security systems and strategies. In addition, our CISO leads the operational cybersecurity team, which has an average of over 10 years of experience. Collectively, the members of the operational cybersecurity team have various certifications, including, but not limited to, CISSP, GSOM, GCIA, GCIH, CISA, CCSK, SSCP, GPEN, CEH, and CISM.


text: Our Processes Regarding Cybersecurity Threats We apply a layered approach, or a defense-in-depth strategy to cybersecurity. This layered approach to security leverages governance, people, processes, and technology to provide our information technology ("IT") teams with preventative measures and strategies such that they are prepared to respond to cybersecurity threats and incidents.

companyName: HERBALIFE LTD.

ticker: HLF


text: We have process, controls and technology infrastructure to maintain, protect, and enhance existing systems and develop new systems as needed to keep pace with continuing changes in technology, evolving industry and regulatory standards, and emerging cybersecurity and data security risks.


text: We collect, process, and analyze threat intelligence data from a variety of sources to understand motives, targets, and attack behaviors.


text: Another aspect of our security program is vulnerability management, which includes, among other things, asset discovery and inventory, third-party vulnerability scanners, patch management and remediation, configuration management, as well as penetration testing.


text: We have monitoring systems which are designed to identify potential cybersecurity events, including threats and incidents. These monitoring systems are managed by our Global Security Operations Center, which employs cybersecurity professionals in the United States and in certain foreign countries in which we operate to provide better coverage and response actions.


text: We also use a Security Information and Event Management (SIEM) platform, providing real-time analysis of security alerts generated by applications and network hardware. This platform helps the Global Security Operations Center in monitoring and responding to security events.


text: We have a multi-functional incident response plan which provides guidance in the event of a cybersecurity incident. The plan is managed by our Incident Management Team, which includes representation from our Global Security, Cybersecurity, Legal, and Finance departments, among others. The Incident Management Team is responsible for responding to an incident, including tasks such as identifying and assessing the nature of the incident, containing the incident, and coordinating with relevant departments. Depending on the nature or severity of the event, the Incident Management Team may escalate the matter to our Executive Leadership Team, which includes the Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel, and other executives. If necessary, the matter could be escalated to our Board of Directors or any appropriate Board committees. This structured governance approach is designed to manage cybersecurity incidents with participation and involvement with the appropriate levels of our organization.


text: External and internal audits are conducted periodically to assess the effectiveness of our cybersecurity measures. These audits include an annual technology risk assessment by our Cybersecurity and IT departments. Our Internal Audit team also conducts cybersecurity risk assessments which include, among other things, evaluating governance of our cybersecurity processes and functions, assessing our ability to identify, validate and remediate vulnerabilities, and evaluating penetration studies. Results of our Internal Audit assessments are shared with our Enterprise Risk Management ("ERM") team, our Technology Risk Committee, and in accordance with our governance structure which includes, among other things, the Audit Committee of our Board of Directors.


text: We conduct vendor security assessments for key service providers as part of our vendor onboarding process and as part of our contract review process. The cybersecurity assessment process includes considerations from an industry leading third-party vendor security ratings company.


text: Our standard agreements with third parties may include, among other provisions, compliance requirements, data protection standards, audit rights, and security incident notification requirements. A dedicated email account and hotline is in place for third parties to report security incidents. The email account and hotline are monitored 24/7/365 by our Global Security Operations Center. Notice of a third-party security incident could trigger the activation of our incident response plan, as further described above.


text: Cybersecurity Governance and Risk Management Systems Our risk management system includes several risk management functions that support our processes for identifying, assessing, and controlling risks to our business, including cybersecurity risks.


text: Our cybersecurity risk management process is integrated with our overarching risk management system, led by our ERM team, and further guided by our Technology Risk Committee. Our Technology Risk Committee is responsible for approving the effectiveness of our cybersecurity risk framework and assisting with the oversight of decisions that affect compliance with applicable legal and regulatory matters and corporate policies. As part of the management oversight structure, the ERM team provides our Management Risk Committee with periodic updates on key risk conditions, strategy and mitigation efforts.


text: Our cybersecurity risk management process, which encompasses continuous monitoring and periodic assessments, is designed to identify and mitigate cybersecurity threats and vulnerabilities. These efforts are aligned with the broader objectives of our ERM team and are continuously reviewed and refined in consultation with our Technology Risk Committee.


text: A key aspect of this integrated framework is the role of our Internal Audit team, which serves as an independent, objective assurance function tasked with evaluating the effectiveness of risk management, internal controls, and our governance processes.


text: Communication channels between our cybersecurity teams and other risk management personnel are established to facilitate the timely sharing of information about potential cyber threats. For example, our Data Protection and Information Security working group, which includes representation by our Chief Information Security Officer (who reports directly to our COO) and CIO, and our Legal, ERM, Information Governance and Finance departments, among others, meets regularly to discuss key risks, strategies and threats related to information security.


text: Our Board of Directors administers a risk oversight function through its Audit Committee, and is supported by our ERM team, including on matters related to cybersecurity risks. This management reporting is designed to give our Board of Directors visibility over our operations and activities to adequately identify key risks, including among other things, cybersecurity risks, and understand management's risk mitigation strategies.


text: Our Cybersecurity department is staffed with professionals holding a variety of IT, cybersecurity and audit best practice certifications, including, among others, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), International Organization for Standardization 27001 Lead Auditor Certification (ISO 27001 LA), Certified Information Privacy Professional (IAPP CIPP/CIPM), Alibaba Cloud's Cloud Security Certification (Ali-ACP), and Certified in Risk and Information Systems Control (CRSC). Our Cybersecurity department also has a training and development program in place so that appropriate skillsets are maintained and/or acquired, and professional certifications remain current.


text: Our cybersecurity teams are supported by training programs and a dedicated learning management system, Herbalife University, whereby all Herbalife employees receive mandatory security awareness training. Specialized training is also assigned to certain functions based on job responsibilities. Training content is purchased from multiple well-recognized third parties. In addition to assigned training, Herbalife University offers additional information security related courses available to all employees on demand.


text: Our cybersecurity program also engages a variety of consultants, auditors and other third parties to support and assist with implementing and maintaining appropriate security measures. Any number of third parties may be engaged to assist in response actions, including, among others, intelligence providers, product, software and service providers and advisors. Professional services, or consultants, are engaged as needed to help implement, support or advise on a variety of technical matters. Legal counsel, law enforcement and external auditors are also consulted as needed.


text: We have already identified and, in some cases, engaged, third-party experts to allow for quicker engagement if a cybersecurity incident occurs in the future.


text: Risks from Cybersecurity Threats As of December 31, 2023 and as of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or nancial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: Our cybersecurity policies, standards, processes and practices are informed by industry-recognized standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.


text: Cyber Risk Management and Strategy Under the board's and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. An internal audit team evaluates the results of these risk assessments to determine critical areas for review as part of our annual internal audit plan. The results of the internal audit plan are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data is in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and annually thereafter for high-risk vendors, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.


text: Incident response: We employ a formal process to identify, track, prioritize and remediate cybersecurity incidents that may impact the confidentiality, integrity and availability of data stored and processed on our information systems. This process addresses event detection, triage and classification, investigation and escalation, containment and mitigation, recovery and corrective actions. We maintain a written incident response plan that establishes roles, responsibilities and procedures to guide incident response operations.


text: Policies and procedures: Our security and legal teams actively participate in industry and other advisory groups and monitor regulatory requirements to keep apprised of evolving risks. Policies and procedures, including our Written Information Security Policy, are periodically updated to adapt to evolving business conditions and information technology requirements.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Board oversight: Our board has final oversight responsibility over cybersecurity-related matters. The full board participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends and information security considerations arising with respect to our peers and third parties.


text: The audit committee assists the board in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board.


text: As appropriate, the board also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.


text: Management's role in assessing and managing cybersecurity risk: Our risk management program for cybersecurity is led by the HubSpot Security & Privacy Committee, which we refer to as the Committee. The Committee oversees our information and technology risk management, compliance, and control functions, and serves as a forum for the discussion of issues involving information security and risk management.


text: The Committee's members include senior members of management who are responsible for and collectively have experience in information security, information technology, data protection, risk management and compliance. This collaboration helps us incorporate cyber risk management across all of our significant risk management programs.


text: The Committee is chaired by the CISO, who works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. The CISO attends regular meetings with representatives from the legal, ERM and security teams to review newly identified cybersecurity risks and re-review previously identified risks. The Committee then determines how identified risks should be treated. The results of these risk review processes are included in periodic presentations to our executive leadership team and the audit committee.


text: Our CISO has over seven years of experience running cybersecurity programs and also served as the leader of the cybersecurity team at his previous organization. Effective March 1, 2024, our CISO will be departing the Company, and our Deputy CISO will be promoted to the CISO role at that time. Our Deputy CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 11 years.


text: Governance Related to Cybersecurity Risks Our board of directors is responsible for overseeing the Company's risk management process. Our board of directors focuses on our general risk management strategy and the most significant risks facing the Company, and works to ensure that appropriate risk mitigation strategies are implemented by management. Our board of directors also is apprised of particular risk management matters in connection with its general oversight and approval of corporate matters.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Our board of directors has delegated oversight of the Company's risk management process to the Audit Committee of our board of directors (the "Audit Committee"). Among its duties, the Audit Committee reviews with management the Company's policies with respect to risk assessment and management of risks that may be material to us, including cybersecurity risk management. The Audit Committee receives, at a minimum, quarterly reports about legal and compliance matters, which can include reporting on cybersecurity incidents occurring or threats that have been thwarted or are being monitored during the prior period, as reported internally by the Chief Information Technology Officer ("CITO").


text: The CITO, who has served in this role for over eight years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.


text: On an annual basis, the CITO presents to the Audit Committee a detailed overview of our IT department's operations, including staffing and risks inherent in this functional area in order to apprise the Audit Committee, among other things, of our cybersecurity risks, how they arise throughout our business and what management's mitigation strategies are. The Audit Committee periodically engages third-party specialists to perform maturity assessments of our cybersecurity program. The Audit Committee reports on these matters to our board of directors as needed. In addition, the CITO periodically presents directly to our board of directors on our cybersecurity program.


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.


text: The Company maintains information systems which contain personal data, financial reports and proprietary data. As a result, we are exposed to cybersecurity threats which could result in loss of or damage to our intellectual property, proprietary information, client data and reputation, or interruption of our business operations, or additional costs to prevent, respond to, or mitigate cyber-attacks.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: Our Board of Directors is responsible for oversight of the risks that the Company faces, including cybersecurity threats. Our operating divisions and management teams help identify risks that are relevant to the Company during our periodic business planning and review cycle and rank these risks in relation to the achievement of business objectives. We understand cybersecurity threats to be dynamic and to intersect with various other enterprise risks within the organization. We have therefore integrated cybersecurity risk into our overall risk management program.


text: As a result, in addition to our information technology policies and procedures, we have implemented cybersecurity processes that aim to address, among other things, information security, password security, third party vetting, security incident response and vulnerability management. Our cybersecurity procedures include requiring multiple authentication factors prior to granting access to our assets, launching endpoint security software to guard against malware, viruses, and other cyber-attacks, use of third-party software to automate IT system monitoring for unusual or suspicious activity, conducting annual cybersecurity training for all employees, and providing cybersecurity information to employees through newsletters and fliers. We utilize third-party consultants to assist us with endpoint detection and response and routinely conduct penetration testing of our network infrastructure. Our consultants also provide digital forensics analysis of our systems, as needed. Additionally, we have sought to align our cybersecurity risk management in accordance with the National Institute of Standards and Technology Cybersecurity Framework.


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: We have established a permanent management position of Director of Cybersecurity and IT Governance that reports directly to the Chief Financial Officer. Our current Director of Cybersecurity and IT Governance, has an undergraduate degree in computer science and is a Certified Information Systems Security Professional. He possesses over 20 years of IT experience with more than 10 years in managerial positions and has been actively involved in IT security related projects, initiatives, audits and associated program management in the last seven years. As part of our cybersecurity incident response plan, we have established a dedicated incident response team to assess and manage risks arising from cybersecurity threats, consisting of our Director of Cybersecurity and IT Governance and various members of senior management, including our Chief Financial Officer and General Counsel.


text: The Company also maintains an IT Steering Committee as part of its control environment, which meets regularly to address matters pertaining to the Company's information technology systems. The IT Steering Committee is led by the Company's three IT directors, one of which is the Director of Cybersecurity and IT Governance, and is represented by leaders from corporate departments and operations. In each meeting, the Director of Cybersecurity and IT Governance provides an overview of cybersecurity matters, including status update on threat reduction initiatives undertaken by the Company and future initiatives under consideration.


text: The Audit Committee is responsible for overseeing our cybersecurity threat risks and receives updates during its quarterly meetings from our Director of Cybersecurity and IT Governance. At each meeting, the Audit Committee is briefed on matters pertaining to our exposure to material privacy and cybersecurity risks, as well as risks that are deemed to have a moderate or higher business impact, even if immaterial. The Director of Cybersecurity and IT Governance also routinely briefs senior management on such matters as they arise.


text: In addition, we have established a Data Privacy Committee coordinated by our Data Privacy Officer and represented by seven other committee members from various corporate functional departments. The objective of the Committee is to ensure that personal data is protected and handled in accordance with applicable law and Core Lab policies.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident or cybersecurity threat that has materially affected, or is reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we understand that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risk. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We devote significant resources to protecting and improving the security of our systems and employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the National Institute of Standards and Technology (NIST), as well as by engaging with experts to attempt to infiltrate our information systems (as defined in Item 106(a) of Regulation S-K).


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), we undertake the below listed activities: • closely monitor emerging data protection laws and, if necessary, implement changes to our policies and employee training processes designed to comply; • undertake regular reviews of our policies and statements related to cybersecurity; • conduct annual cybersecurity awareness training for all relevant employees to increase their awareness and responsibilities when faced with cybersecurity threats; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees to enhance awareness and responsiveness to such possible threats and provide supplemental training when appropriate; • through policy, practice, and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and Additionally, we carry information security risk insurance coverage that we believe to be appropriate for the potential losses arising from a cybersecurity incident. However, this insurance may be subject to certain exceptions and may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third-party qualified security assessor review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform pre-engagement assessments for all third-party service providers based on the sensitivity of the data that will be handled and stored by that third-party service provider. Annually, we review Service Organization Control (SOC) 1 or 2 reports for certain outsourced service providers whose systems are utilized in processing and recording company or employee data.


text: Cybersecurity is an important part of our risk management processes and an area of continued focus for our board and management. The audit committee of the board of directors is responsible for the oversight of the company's enterprise risk management program, including reviewing and discussing with management at least annually (i) management's report on risk management, including management's assessment of risk exposure (for example, risks relating to operations, climate change, cybersecurity threats and regulatory compliance, among others), the processes in place to identify and manage significant risks, and steps taken by management to control or mitigate such exposures, and (ii) management's report on cybersecurity risk management, which may include a review of the company's cybersecurity framework, priorities, risk profile, and processes, controls and strategy to mitigate data protection and cybersecurity risks. Pursuant to the company's incident response plan, management would discuss with the audit committee any significant cybersecurity incidents that may have a material effect on the company's business or its financial statements and management's mitigation and remediation plan for such incidents.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Information Technology Director (IT Director) and Director of Information Security (IS Director). Our IS Director has over ten years of experience managing information security, developing cybersecurity strategy and implementing relevant and effective cybersecurity programs. Together, our IT Director and IS Director hold numerous credentials, including a Bachelor of Science in Cybersecurity & Information Assurance, Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Global Information Assurance Certification (GIAC), Certified Forensics Analyst (GCFA), GIAC Certified Incident Handler (GCIH), and others.


text: Our IT Director reports directly to the Chief Financial Officer, which enables quick notification to the entire management team of any significant cybersecurity incidents. The management team and the enterprise risk committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our IT Director also reports at least annually to the audit committee about cybersecurity threat risks, among other cybersecurity related matters, and our Chief Executive Officer reports regularly to the chair of our board of directors, and the full board of directors, as appropriate, about any emerging threats to our operations, at scheduled board meetings and through communications between board meetings.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. For more information about cybersecurity risks we face, see the risk factor titled "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" included as part of our risk factor disclosures within Part I – Item 1. Business, Item 1A. Risk Factors contained in this report.


text: Cyber Risk Management The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: Our cyber risk management program includes: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations.


text: Cybersecurity Strategy Our cybersecurity strategy is aligned with our overall business objectives and includes the following key elements: • Implementation of multiple layers of security controls, including firewalls, intrusion detection and prevention systems, endpoint protection and encryption, to safeguard our information assets. • Ongoing education programs for employees to enhance their awareness of cyber risks and promote a culture of cybersecurity throughout the organization.


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization.


text: Regulatory Compliance We remain committed to complying with all relevant cybersecurity regulations and standards applicable to our industry. Our governance structure is designed to adapt to evolving regulatory requirements and industry best practices.


text: While we believe our current measures are robust, we recognize the dynamic nature of cyber threats and continually refine our approach to remain vigilant and responsive.


text: This disclosure provides stakeholders with a comprehensive overview of the organization's cyber risk management, strategy and governance practices, demonstrating a commitment towards proactive cybersecurity measures and compliance.


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under Risks Relating to Our Business in Item1(a) Risk Factors.


text: Cybersecurity Risk Management and Strategy We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Senior Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including an annual maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or cash flows.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Senior Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Information Officer, Chief Risk Officer, General Counsel, Co-Chief Operating Officer and Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 17 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Directors is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Directors at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.


text: As part of our cybersecurity risk management framework, we have implemented comprehensive Corporate Incident Response Plans (IRPs) and other policies and procedures designed to ensure the assessment, identification, and management of material risks from cybersecurity threats, and to facilitate timely disclosure of material cybersecurity incidents in accordance with SEC rules. Our policies provide for cybersecurity awareness training for employees and engagement in due diligence processes in accordance with industry best practices for third-party vendors, including those handling critical services or sensitive data on our behalf. Our policies also provide for regular, senior management-led table-top exercises simulating cyberattack scenarios to ensure preparedness and response agility. We undertake an annual review of our policies to help ensure their effectiveness and relevance in light of evolving cybersecurity threats. Additionally, we maintain cyber insurance to help cover costs associated with the occurrence of certain cybersecurity events. We do not currently engage any other third parties as part of our cybersecurity risk management framework, but we do use third party services and products in the ordinary course with respect to certain common cybersecurity threats.

companyName: Strategy Inc

ticker: MSTR


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all MicroStrategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Information Officer (CIO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.


text: Our CIO and CISO oversee our cybersecurity preparedness. Our CIO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining MicroStrategy in 2018. Our CISO, who joined MicroStrategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CIO.


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the direct oversight of our board of directors and senior management. MicroStrategy's management, including our CIO and CISO, provides the board of directors with regular updates on cybersecurity incidents and emerging threats. The board actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, such incidents have not materially affected, nor are they reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."


text: We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Prevention, Identification, Detection and Mitigation Activities We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following: • Procedures and guidelines designed to ensure that information security is a key consideration in the requirements for both new information systems and enhancements to existing systems and assets; • IT environment risk assessments conducted at regular intervals and in connection with certain events, such as implementation of a new system, service or vendor; • Tabletop and simulation exercises to discuss roles and responsibilities of team members in the event of a cybersecurity incident and to test and modify the plan as needed; • Ongoing security penetration testing and threat modeling of our network and web application; • Automated tools and manual review processes to ensure ongoing compliance with technical standards and identify configuration issues and technical vulnerabilities; • Encryption of all communications with our servers, which are configured to utilize only high-grade encryption algorithms; and • Ongoing employee training related to information security and data privacy policies and standards, including periodic phishing, vishing, and social engineering exercises.


text: We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: Incident Response We maintain plans to address any cybersecurity incidents, including but not limited to Crisis Management Policies and Procedures, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency/Continuity Management Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team's ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee on a quarterly basis.


text: Certifications and Audits We maintain the following ISO certifications related to our information systems: • ISO 22301:2019 (standard for implementing and managing an effective business continuity management system); • ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments); • ISO 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and • ISO 9001:2015 (standard for the implementation of quality management processes).


text: We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, processing integrity, confidentiality and privacy. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.


text: Impact of Risks from Cybersecurity Threats We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition.


text: Both management and the Board of Directors are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board of Directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board of Directors The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Executive Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company's information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.


text: Role of Management The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Executive Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Executive Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 25 years. The Executive Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.


text: The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT Security, Executive Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Executive Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.