text: We continue to improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. We are also required to maintain strong cyber defense protocols in the states where we are authorized or licensed to write business. We monitor the status of new cybersecurity regulations, including notification requirements.


text: To the best knowledge of management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT

secItem: Item 1C


text: Our Board is ultimately responsible for the oversight of risk management strategy, business plan and management of financial resources. As part of these responsibilities, the Board is apprised, annually and as needed, of developments in the external environment and business strategies that present increased cyber risk exposure to the Company. On a weekly basis, The Vice President of Management Information Services ("VP of MIS") meets with the Chairman of the Board of Directors, President and Chief Executive Officer ("Chairman, President and CEO"), to discuss developments with the Company's IT environment, including its cybersecurity program. The Chairman, President and CEO would then inform the Board of those developments, as needed. The Board has delegated oversight of cybersecurity risk management to the Audit Committee of the Board of Directors.


text: The Audit Committee meets on a quarterly basis. A set agenda of risk matters includes detailed updates of the Company's preparedness and significant cybersecurity activities. The topics covered by these updates have included discussions of policies and procedures to prevent, detect and respond to cybersecurity incidents, modifications to on-line platforms, and the use of cloud-based applications. Lessons learned from cybersecurity incidents and the internal and external testing of our cyber defenses are provided quarterly. The Board is also provided with an annual cybersecurity technology risk and control update.


text: A management level risk committee exists and oversees the management of the Company's highest-level risks, including cybersecurity. This committee consists of representatives from the Risk, Financial, Underwriting, Information Technology and Legal Departments. The Risk Committee, as supported by the Cybersecurity Committee, is responsible for keeping the audit committee apprised of the Company's cybersecurity preparedness and cyber incidents. The Cybersecurity Committee oversees and ensures the Company's cyber-related controls are sufficient to protect the Company's information and proprietary assets, in accordance with the acceptable risk policies and risk tolerances.


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 31-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 32-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: HAWAIIAN HOLDINGS INC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Senior Director, Information Protection & Compliance, who reports to our Chief Information Officer (CIO), to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and regularly train our employees on these safeguards, in collaboration with management, including phishing tests and third party training modules.


text: We engage assessors, consultants and other third parties in connection with our risk assessment processes. These service providers review our cybersecurity policies, procedures and safeguards and provide feedback to increase the effectiveness of our cybersecurity controls.


text: Table of Contents, We require third-party service providers that process personal information on our behalf to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled, "Our actual or perceived failure to protect consumer information or other personal information or confidential information could result in harm to our business."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors oversees our cybersecurity risk management. The Company's Audit and Finance Committee periodically reviews with management the Company's operational risk exposure related to cybersecurity and information technology and the steps management has taken to monitor and control these exposures, including the Company's related guidelines and policies.


text: Our Senior Director, Information Protection & Compliance directly oversees our information security team and has over twenty years of experience in the information security industry and industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager. Our Senior Director, Information Protection & Compliance and our management committee on cybersecurity, which includes our Chief Executive Officer, Chief Operating Officer, Chief Legal Officer, and CIO are primarily responsible to assess and manage our material risks from cybersecurity threats. This same group oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.


text: The processes by which our Senior Director, Information Protection & Compliance and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: bimonthly management committee on cybersecurity meetings, formal e-mail notifications, and CIO updates as part of regular Executive Officer meetings.


text: Our management team provides the Audit and Finance Committee with quarterly briefings regarding enterprise risks, and reviews enterprise risks with the Board of Directors on an annual basis. Cybersecurity risks are included in these reviews, and our Senior Director, Information Protection & Compliance, CIO and representatives from our management committee on cybersecurity periodically provide more detailed cybersecurity-focused briefings to the Audit and Finance Committee and Board of Directors regarding cybersecurity risks and activities, including notable recent cybersecurity incidents and related responses.


text: The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.

companyName: HYSTER-YALE, INC.

ticker: HY


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Cybersecurity Committee (the "CSC") oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify and detect cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats.


text: The CSC is chaired by a member of the Office of the Chief Information Security Officer ("Office of the CISO") and includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. In coordination with the Office of the CISO, the CSC reviews and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.


text: The CSC works with the Company's Office of the CISO, which is responsible for the daily direction of cybersecurity risk activities. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Office of the CISO consists of the Director of Cybersecurity, the Chief Information Officer and other information technology and cybersecurity specialists. The Office of the CISO has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management.


text: In addition, the Company engages third parties to assist in assessing, enhancing, implementing and monitoring the Company's cybersecurity risk-management programs. The Company maintains processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: The Company has experienced cybersecurity threats and vulnerabilities in its information systems and those of third-party providers. Such prior events have not had a material impact on the Company's financial condition, results of operations or liquidity. If, in the future, the Company's or a third-party provider's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation with third parties, government enforcement actions, penalties, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption of data or remediation costs, which could materially adversely affect the Company's operating results, financial position or reputation. See "Risks Related to Cybersecurity" in "Risk Factors" beginning on page 11 of this Annual Report on Form 10-K.


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.


text: The Company's Office of the Chief Information Security Officer ("Office of the CISO"), which is responsible for the daily direction and management of cybersecurity risk activities, consists of the Chief Information Security Officer, Chief Information and Digital Officer and other information technology and cybersecurity specialists. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Chief Information Security Officer has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management, and is a Certified Information Security Manager and a Certified Data Privacy Solutions Engineer.


text: The Company's Office of the CISO chairs the Company's Cybersecurity Committee (the "CSC"), which oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify, detect, assess and manage risks from cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats. The CSC includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. On behalf of the CSC, the Office of the CISO review and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.


text: The Company has experienced cybersecurity threats, cybersecurity incidents and vulnerabilities in its information systems and those of third-party business partners. As of the date of this filing, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. If, in the future, the Company's or a third party's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation including individual claims or consumer class actions, commercial litigation, administrative, civil or criminal investigations or actions, regulatory intervention, government enforcement actions, penalties, sanctions or fines, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption or alteration of data, payment of ransom, or investigation and remediation costs, which could result in a negative impact on the Company's business strategy, results of operations, financial condition or reputation. See "Risks Related to Cybersecurity" in Part I, Item 1A. Risk Factors, in this Annual Report on Form 10-K.


text: Risk Management and Strategy Nicolet is susceptible to information security breaches and cybersecurity-related incidents like any other entity. Risks related to cybersecurity attacks are expected to remain heightened as digital capabilities continue to evolve. Increasing use in digital platforms create a vast footprint for sophisticated threats to attack organizations internally and externally, blurring the outermost edge of security. To mitigate these risks, resources are employed to provide visibility, prevention, and mitigation strategies, in line with information security standards.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: Our management IT Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.


text: To our knowledge, no cybersecurity incidents or threats have resulted in a reportable event, and have not materially impacted Nicolet's operations or financial condition. For additional discussion of cybersecurity risks, see Item 1A, "Risk Factors – Operational Risks."


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our CISO has substantial relevant experience in the areas of physical security, information security, and cybersecurity risk management.


text: The management IT Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Audit & Compliance Committee having primary oversight responsibility. The Audit & Compliance Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. Additionally, the full Board receives regular presentations by our CISO regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators and notable internal events. In addition, the Audit Committee receives prompt reporting and updates on significant cybersecurity-related incidents.


text: Our management Info Sec Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program, in conjunction with our CIO and Director of IT. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our information security team has substantial relevant experience in the areas of information security and cybersecurity risk management.


text: The management Info Sec Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, risk, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Risk and Audit Committees having primary oversight responsibility. The Risk Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. In addition, the Audit Committee receives prompt reporting and updates on IT audits and material cybersecurity-related incidents. The full Board receives regular presentations regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators, and notable internal events.


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: The Board of Directors oversees risks relating to cybersecurity. The CISO presents to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. The CISO has overseen the Company's information security program for the last 15 years. He holds a Bachelor of Arts degree in Business Administration, and has over 30 years' total experience in the information technology and security field, including various leadership roles before joining Wynn Resorts. In addition, he holds several industry technical certifications in information security, network engineering, systems engineering, database management, application development, and security intrusions.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business" in Item 1A — "Risk Factors."


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government and is integrated into our overall enterprise risk management system.


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and evaluate whether the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as practicable in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business " in Item 1A — "Risk Factors."


text: has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Risk Oversight Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: STURM RUGER & CO INC

ticker: RGR


text: has an Information Security Program ("Program") to protect personal and proprietary information in compliance with applicable federal and state requirements. The Program is designed to: Ensure the security and confidentiality of employee and customer personal information and Company proprietary information;


text: Protect against anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to, use of, or transfer of such information in a manner that could harm or inconvenience the Company, employees or customers.


text: information about these risks, see the risk factor titled "The Company relies on its information and communications systems in its operations. Security breaches and other disruptions could adversely affect its business and results of operations" under Item 1A.


text: The Company's Board of Directors has assigned oversight of cybersecurity risk management to the Risk Oversight Committee. The Risk Oversight Committee regularly receives reports from management, including senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Company's full Board of Directors receives reports addressing cybersecurity as part of the Company's overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Senior IT leaders are responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Risk Oversight Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Cybersecurity Program The Company's cybersecurity program is an integral element of the Company's overarching strategic plan. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: The Company continually evaluates and refines its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance from external security consultants. The Company's cybersecurity program relies on three key pillars: People, Process and Technology (PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited to: Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools; Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access; Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;


text: Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols. All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.


text: Our Chief Technology Officer (CTO), with over 25 years of experience in various disciplines of information technology, oversees the cybersecurity program. Reporting to the Chief Executive Officer, the CTO provides regular briefs to the Board of Directors (the Board) and executive management, informing them about prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as ongoing risks and threats.


text: In our industry, the continuous functioning of information systems is of the utmost importance. Leveraging information technology systems, we collect, process and safeguard sensitive data and utilize automated tools to operate our plants.


text: Identified as a critical risk factor, cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks.


text: These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.


text: Our cybersecurity program aims to protect the uninterrupted availability of critical information technology resources. Regular assessments, conducted both internally and by third parties, evaluate our program against industry standards, including the National Institute of Standards and Technology Cybersecurity Standard and the Risk Management Framework.


text: Although we have not experienced cybersecurity breaches or incidents that have significantly impacted our financial condition, results of operations, or business strategy, the effectiveness of our measures to prevent, detect, mitigate, or recover is based on currently known threats and recovery methods. There is no guarantee that cybersecurity breaches or incidents will not impact our business operations, strategy, financial condition, or operations.


text: The ever-evolving landscape of cybersecurity threats introduces ongoing challenges. The Company recognizes the increasing frequency and sophistication of these threats. Despite implementing measures to secure operational and technology systems and fostering a culture of continuous improvement, the dynamic nature of cyber-attacks and vulnerabilities implies that these defenses may not be foolproof.


text: Cybersecurity Risk Management Program and Strategy Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;


text: Deployment of automation solutions to strengthen detection and response capabilities; and Utilizing services offered by the United States Department of Homeland Security to assist with resiliency planning.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations. In connection with these relationships, we perform due diligence, cyber risk scoring, cybersecurity related contractual obligations, and periodic reviews of third-party control environments to ensure alignment with the Company's risk exposure, business requirements, and risk tolerances.


text: We extend our cybersecurity focus to third-party service providers by evaluating and monitoring their cybersecurity risks. High-risk vendors undergo continuous monitoring, and we maintain contractual agreements that mandate our third-party providers' commitment to managing cybersecurity risks, providing incident notifications, and being subject to cybersecurity audits.


text: Cybersecurity Governance The Corporate Governance and Nominating Committee of the Board is tasked with overseeing cybersecurity risk. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: ENB Financial Corp

ticker: ENBP


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees. The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.


text: The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.


text: The ISO maintains risk assessments for critical IT systems, vendors, and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are used annually to assess these risks. Third parties are assessed to address their risks according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology. We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: Access to data on the Corporation's networks is granted only if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual review.


text: An Incident Response Team that includes representatives from key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.


text: The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company's existing controls. Upon identification and assessment of risks, the Company develops and implements what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company's overall enterprise risk assessment process.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Audit Committee and the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: During the fiscal year ended June 30, 2024, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD).

companyName: ESPEY MFG & ELECTRONICS CORP

ticker: ESP


text: All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees.


text: Cybersecurity Program The Company's cybersecurity program is an integral element of the Company's overarching strategic plan and risk management system. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.


text: Cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks. These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.


text: Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;


text: Cybersecurity Governance The Corporate Governance and Nominating Committee of the Board is tasked with serving as the Board of Director's primary body to oversee management's risk identification, management and mitigation strategies related to, among other risks, information technology, cybersecurity and data security risks. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees.


text: The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors. The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology.


text: We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD). All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. Our program to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: Our cybersecurity risk management the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis; cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Prevention System (IPS) that scans data in transit to help prevent the execution third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: Our Board of Directors has oversight responsibility for the Company's cybersecurity risk management, including technology and cybersecurity risks facing the Company. Management updates the Board, as necessary, regarding cybersecurity risk management matters, including reporting any material cybersecurity incidents.


text: Our management team, including the CEO, CFO, COO, Senior Director of Information Technology, Director of Information Technology, and Director of Accounting, as appropriate, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy The Partnership recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Managing Material Risks & Integrated Overall Risk Management The Partnership has strategically integrated cybersecurity risk management into our broader risk management framework to promote an entity-wide culture of cybersecurity risk management. Our information technology department works closely with our internal audit, risk, and legal teams to continuously evaluate and address cybersecurity risks and ensure cybersecurity measures are in alignment with our business objectives and operational needs.


text: Our cybersecurity measures are designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use multiple monitoring and detection tools to safeguard network and endpoint devices. We have implemented measures that proactively and continuously assess and monitor our information systems for vulnerabilities and cybersecurity exposure.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Partnership engages with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, network penetration testing, threat assessments, and consultation on security enhancements.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees with network access are required to complete annual security awareness training and quarterly spear phishing exercises.


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party vendors, service providers and business partners, we have implemented stringent processes to oversee and manage these risks. We conduct thorough and annual security assessments of all third-party file transfer protocols, and we perform in-depth reviews of hosted applications including, but not limited to, confirmation of SOC 2, ISO 27001, or other relevant security certifications.


text: Risks from Cybersecurity Threats We have not been subject to cybersecurity challenges that have materially impaired or are reasonably likely to materially impair our operations or financial standing.


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The board has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Partnership's board of directors has oversight of cybersecurity risks. Our board of directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the board of directors on cybersecurity risks. They provide comprehensive briefings to the board of directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the board of directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The board of directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The board of directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Monitor Cybersecurity Incidents The Director of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Director of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Partnership's information technology team is equipped with an incident response plan. This plan includes immediate actions to mitigate and contain the impact and strategies for remediation and prevention of future incidents.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board of Directors has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board of Directors recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Partnership's Board of Directors has oversight of cybersecurity risks. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to the Board of Directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board of Directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board of Directors' oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The Board of Directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to the Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as other globally recognized standards. The NIST framework is structured around six Core Functions (Govern, Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our program includes policies, practices, procedures and controls designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments.

companyName: TD SYNNEX CORP

ticker: SNX


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our company's broader overall risk assessment process. We refine our cybersecurity program by staying informed on security threats, conducting tabletop exercises to proactively identify areas for improvements, and leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. We utilize a third-party remediation team on retainer for assistance in investigating and addressing cybersecurity incidents or threats. We maintain procedures for screening and evaluating third-party providers prior to granting them access to our information systems. Depending on the nature of the product or service to be provided, we screen any third-parties that could present a cybersecurity risk through a cyber risk assessment, and we review third-party suppliers post-engagement to identify changes in their security risk profile, including the occurrence of cybersecurity events affecting such suppliers. Contractual and statutory provisions require third-party suppliers to inform us of cyber incidents, in most cases. Additionally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents.


text: While we focus on prevention and detection, we also have incident response and recovery plans in place designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. In the event of a cybersecurity incident, our incident response process involves assessing incident severity, conducting root cause analysis, creating and implementing plans to address the incident, mobilizing appropriate resources and identifying potential remedial measures and other appropriate next steps. We also have on retainer a third-party consultant to assist us in our incident response and remediation.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see " Item 1A. Risk Factors."


text: We have a team of information security professionals who lead our enterprise-wide cybersecurity strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO") and works with our Chief Legal Officer. Our CISO has over 30 years of experience in the fields of cybersecurity and intelligence with the Department of Defense, the defense contracting community and with publicly traded companies, and holds various technical credentials in the field, including a CIO Program Certificate from the College of Information and Cyberspace, National Defense University, and maintains a Certified Information System Security Professional ("CISSP") designation as well as a Certified Information Privacy Professional ("CIPP") designation.


text: The Board of Directors is responsible for overseeing our enterprise risk management process, including our information security program, compliance and risk management and cybersecurity risks. The CISO regularly provides reporting on cybersecurity matters to senior management and reports to the Board of Directors on at least a semi-annual basis and, going forward, to the newly formed Technology Committee of the Board of Directors on at least a quarterly basis. This reporting includes updates on our information security strategy, key cyber risks and threats, progress towards protecting the Company from such risks and threats, and assessments of our cybersecurity program with regard to emerging trends. Depending on the magnitude of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our security incident response plan.


text: The Board of Directors is in the process of creating a Technology Committee to have an oversight role regarding technology-based issues, including in relation to cybersecurity and generative artificial intelligence. With respect to cybersecurity, the committee's role may include assisting the Board of Directors in evaluating management's role in preparing, presenting and assessing our IT systems, reviewing our cyber risks and strategies as well as any significant incidents, and providing guidance regarding the Company's cybersecurity compliance obligations.


text: Cybersecurity risk is assessed at the enterprise level as part of our overall enterprise risk management program. We maintain a dedicated cybersecurity function and program that is led by the Chief Information Security Officer ("CISO").

companyName: FIVE BELOW, INC

ticker: FIVE


text: The cybersecurity function performs an annual threat and risk assessment that drives our security strategy. The strategy is aligned to the ISO 27001/02 and NIST cybersecurity frameworks, which drive our security policies and procedures. These policies and procedures, along with enabling security technology and qualified security function employees, maintain activities to prevent, detect, and minimize the effects of cybersecurity incidents. Cybersecurity technology and practices are in place to enable the protection of consumer and employee personal data and confidential information.


text: We maintain incident response plans and playbooks that allow for cybersecurity incident response, management and recovery in the event of an incident. These plans are tested on an annual basis.


text: We periodically engage qualified third parties to perform external assessments and audits of our overall security program, as well as to perform detailed security assessments of various components of our overall technology infrastructure. We also supplement our own internal expertise with qualified third parties to engage in varying security operational functions aiding in the identification and remediation of potential cybersecurity threats.


text: We require employees and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: We have integrated governance processes into our overall risk management framework to enable the Board of Directors to oversee cybersecurity risk. The Audit Committee oversees management's policies and procedures related to cybersecurity risk management and periodically reports to the Board of Directors. The Chairman of the Audit Committee acts as the lead with respect to direct oversight of management.


text: Our Board of Directors considers cybersecurity risks through interaction with our management team and the Audit Committee, as well as through quarterly updates with our CISO.


text: Management informs the Audit Committee of material aspects of our cybersecurity program on a quarterly basis. This includes informing the committee on key strategic and operational goals, risk mitigation efforts, performance metrics, and descriptions and notification of emerging or existing risks as well as incidents impacting us.


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO, who has served in various roles in information technology, technology audit and security over the past 38 years, including serving as a senior partner in charge of various information security and business resiliency practices at one of the Big 4 Accounting consultancies, advising some of the largest public company leadership teams and boards of directors on cyber related issues and projects. The CISO also served as the CISO for one of the Big 4, as well as a retail ecommerce business virtual CISO. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional certification of Certified Information Systems Auditor.


text: Management is informed of cybersecurity risks and activities as part of the quarterly business review of the Information Technology function.


text: We require the crew and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third-party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO with over 25 years of Information Technology experience in retail for several globally recognized brands, with the majority of their career focused on all aspects of cybersecurity from delivery to operations including incident response. The CISO holds a Master's Degree in Information Technology, has attained the professional certifications of Chief Information Security Manager and National Association of Corporate Directors, and actively participates in the cybersecurity industry through advisory boards and forums that promote peer to peer collaboration.


text: Risk Management and Strategy We have in place a cross-functional, enterprise-wide cybersecurity program that is integrated into our overall risk management process and strategy and has direct involvement from our senior management and board oversight. Our cybersecurity program is based on industry standard CIS critical security controls. The top risks facing our Company, including those related to cybersecurity, are included in our overall enterprise risk management program that is managed by a cross-functional group chaired by our compliance and internal audit functions.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: To assess, identify, and manage material risks from cybersecurity threats to our information systems and the associated costs, our cybersecurity program prioritizes vulnerability management and risk reduction, detection and prevention. As part of this program, we conduct continuous monitoring for anomalous behavior using a third-party security operations center. In addition, we conduct an annual cybersecurity risk assessment in conjunction with our third-party consultant that specializes in information security, and we incorporate recommendations from the risk assessment into our cybersecurity strategy, as appropriate. This risk assessment process considers the nature of our business, requirements from our internal and external stakeholders, and industry trends and risks, including new and emerging risks. By continuously assessing the cybersecurity landscape, we develop targeted strategies that identify and address the risks most likely to impact our company. We also conduct at least one cybersecurity incident tabletop exercise each year to test and enhance our incident response plans.


text: Our cybersecurity program is designed to detect and prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, efficiently remediate and recover from cybersecurity incidents and ensure compliance with regulations and disclosure requirements. Pursuant to our processes, when a cybersecurity incident occurs, we convene a cross-functional incident response team whose membership is dictated by the severity of the incident but in all instances includes representatives from our information technology, legal and accounting departments. This cross-functional representation allows us to leverage diverse perspectives and expertise when addressing cybersecurity events and to analyze the potential financial, legal, operational, and reputational implications of an incident, thereby enabling us to make informed decisions and take appropriate actions. This incident response framework further enables us to quickly assess the severity of cybersecurity incidents and the materiality of incidents based on pre-defined criteria that considers both quantitative and qualitative factors to determine the appropriate response. Identified incidents are then escalated to the relevant management teams based on their severity, allowing for a swift determination of materiality and an effective mitigation process. If we determine that an incident is not material, we continue to monitor it for subsequent developments.


text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by each third-party service provider. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.


text: Additionally, to minimize our enterprise-wide risk and exposure to material cybersecurity incidents, we conduct annual cybersecurity awareness training and education for our employees. By equipping our employees with the necessary knowledge and skills, we intend to cultivate a cybersecurity-conscious culture within our organization.


text: We maintain insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cybersecurity attack or a security breach. Such insurance is subject to several exclusions and may not cover the total loss or damage caused by an attack or a breach. Consequently, costs related to incidents may not be covered by insurance.


text: Impact of Cybersecurity Risks on Strategy and Results Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.


text: We believe that our current cybersecurity program provides adequate measures of protection against cybersecurity breaches and generally reduces our risks. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.


text: Our board of directors is responsible for cybersecurity risk management and oversight of our cybersecurity program. The nominating and corporate governance committee of the board of directors assists in the oversight of management's implementation of our information technology policies and monitoring of the risks associated with our information systems, including reviewing and discussing with management our program to identify, assess, manage and monitor cybersecurity risks. The nominating and corporate governance committee regularly reviews technology strategies, physical and cybersecurity threat assessments, emerging issues and related initiatives. In addition, the audit committee of the board of directors coordinates the board of directors' oversight of our disclosure controls and procedures and ensures that we have in place appropriate internal controls, risk assessment policies and procedures, incident response plans and reporting mechanisms. The nominating and corporate governance committee coordinates with the board of directors and audit committee, as appropriate, on matters related to cybersecurity risk.


text: Our board of directors delegates execution of our cybersecurity program to our Chief Information Security Officer, or CISO, who is responsible for the day-to-day management of our cybersecurity program. Our CISO has over 25 years of information security and information technology risk expertise in multiple industries, including financial, manufacturing, healthcare and life sciences, and holds industry standard certifications, including CISSP, CRISC and CISM. Our CISO, together with our Chief Information Officer, or CIO, provides at least two presentations each year to our board of directors or nominating and corporate governance committee on cybersecurity incidents, security program updates and ongoing risks, with additional updates being provided on an as-needed basis. Our CISO also meets periodically with our senior leadership team to review metrics on readiness, incidents, mitigations and remediation. In addition, our internal audit team performs periodic audits of our systems and cybersecurity processes, the results of which are reported to the audit committee and our senior management team.


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and senior vice president investor relations and corporate communications. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.