text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: VORNADO REALTY LP

secItem: Item 1C


text: Our Board of Trustee's considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics from our Chief Information Officer. The Committee reports to the full Board of Trustees regarding its activities, including those related to cybersecurity. The full Board of Trustees also receives briefings from management on cybersecurity matters as needed.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Trustees.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant relationships, for internal communications, for accounting to operate our record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our technology department continuously identifies, evaluates and manages material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties include regular monitoring, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company or the Operating Partnership, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including the risk factor entitled "Cyber-attacks or acts of cyber-terrorism could disrupt our or our third-party providers' business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information", for additional discussion about cybersecurity-related risks.


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity-related risks, to help align our risk exposure with our strategic objectives.


text: Board of Directors Oversight The Audit Committee of the Board oversees our annual enterprise risk assessment, where we assess key material risks within our Company, including technology risks and cybersecurity threats. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.


text: Management's Role Managing Risk Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity related risks are included in the population that the ERM function evaluates to assess the top risks to the enterprise on a quarterly basis. To the extent the ERM process identifies a heightened cybersecurity related risk, management develops risk mitigation plans to minimize the risk. The ERM annual risk assessment is presented to the Audit Committee of the Board.


text: Monitor Cybersecurity Incidents The Senior Vice President of Information Technology ("SVP IT") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP IT to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).


text: Reporting to Board of Directors The SVP IT plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP IT provides periodic reports, on at least a quarterly basis, to the Audit Committee.


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP IT regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: As of the date of this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats as well as challenges to our business from evolving information technology systems. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity risks such as network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as generative artificial intelligence and machine learning, to help align our risk exposure with our strategic objectives.


text: Monitor Cybersecurity Incidents The Senior Vice President of Technology ("SVP Technology") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP Technology to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).


text: Reporting to Board of Directors The SVP Technology plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP Technology provides periodic reports, on at least a quarterly basis, to the Audit Committee.


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP Technology regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: In the event of a cybersecurity breach, the Company would execute its incident response plan, which provides a structured response, including proper reporting and communication of the incident. When a cybersecurity incident is determined to be significant, it is addressed by Senior Director of Information Technology using processes that leverage subject-matter expertise from across the Company. Further, the Company typically will engage third-party advisors as part of our incident management processes. All cybersecurity incidents that are identified as having the potential to be highly significant to the Company are brought to the attention of SVP, Chief Financial Officer as part of our cybersecurity incident response processes. The Company's executive management would report such incidents to the Company's Board of Directors as deemed necessary based on the overall significance and impact to the Company.


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors.


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within Item 1A Risk Factors.


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. Our cybersecurity strategy is largely guided by key principles and frameworks from the National Institute of Standards and Technology (NIST). The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.


text: Our cybersecurity team has an average of over 25 years of experience in information technology, security, and risk management, including individuals with a master's degree in business administration as well as a master's degree in cybersecurity.


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors. Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from management on cybersecurity risks and threats.


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within "Item 1A – Risk Factors" in Part I of this Form 10-K.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of maintaining the trust and confidence of patients, business partners, payors, clinical trial participants, and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We generally follow the HITRUST Common Security Framework in our cybersecurity policies, standards, processes, and practices.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity risk management program that includes the identification, prioritization, and management of technical and non-technical risk to the confidentiality, integrity, or availability of patient, employee, clinical trial participant, payor, business partner, and company information. This program considers the risks associated with our industry and the technical and regulatory requirements related to the information systems and data involved. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts (as applicable), we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, loss of data and other disruptions, including from cyberattacks, could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" which disclosures are incorporated by reference herein. We did not experience any material cybersecurity incidents during the last fiscal year.


text: We have an incident response plan and processes in place for responding to cybersecurity incidents. The process includes steps to identify, contain, investigate, and remediate the impacts of the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. The plan involves the participation of a security incident response team that includes our Chief Legal Officer, our Privacy Officer, and other senior leaders in finance, communication, human resources, and legal. The plan includes procedures to communicate the incident to management and customers as appropriate and to provide information as required to state and federal law enforcement and regulatory bodies.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient, payor, business partner, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, our data, or our facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Role of the Board Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.


text: Role of Management Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer, who is supported by our leaders in Information Technology, Information Security, and IT Security Compliance. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering regularly report to our Audit and Finance Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks, and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts, as applicable, we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor "Security breaches, loss of data and other disruptions, including from cyberattacks and other cybersecurity incidents, could compromise personal, confidential, or other sensitive or proprietary information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation", included in Part I, Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference into this Item 1C. We did not experience any material cybersecurity incidents during the last fiscal year.


text: Role of the Board of Directors Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.


text: Risk Management and Strategy We work proactively to identify, evaluate, and manage cybersecurity threats to our business. These threats include disruption and denial of critical systems and infrastructure, intellectual property theft, fraud, extortion, harm to customers and employees, legal and litigation risks, reputational risks, and the breach of confidential business data, which could include personally identifiable information. We employ both holistic and focused processes for identifying, assessing, managing, and disclosing material cybersecurity risks to our business. Our holistic review is part of our general risk management process, and involves our executive leadership team, team members from our finance, legal, tech, and operations teams, and external legal, financial, and risk advisors who are subject matter experts in identifying, assessing, mitigating and reporting material risks. Our focused review involves internal assessment by our cybersecurity team, as well as external review by a cybersecurity consulting services firm, to evaluate our cybersecurity program and our capacity to defend against and respond to potential cybersecurity threats.

companyName: COPART INC

ticker: CPRT


text: Through strategic investments over several years, we have established and enhanced a comprehensive cybersecurity program consisting of security toolsets, people, policies, and contracted third-party service providers that provide technical, organizational, and administrative safeguards to protect against and timely respond to cybersecurity threats and incidents. Our cybersecurity strategy is based foremost on defense in depth, and secondarily on resilience. Defense in depth is a strategy of layered security, in which we employ a variety of overlapping controls, tools, and processes to defend against threat actors. Resilience is a strategy focused on business continuity and disaster recovery, with the goal of rapidly restoring, rebuilding, and recovering from any adverse cyber impacts to our business. These controls, tools and processes include technologies designed to detect and defend against unauthorized access to our systems and infrastructure, relevant corporate policies, periodic cybersecurity and privacy training programs, and incident response protocols for preventing, detecting, responding to and recovering from cybersecurity incidents. We use the National Institute for Standards in Technology (NIST) security framework to evaluate our cybersecurity controls, which we work to continuously enhance.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition" included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.


text: Our Board of Directors has delegated oversight of our cybersecurity program to our Audit Committee, and this oversight responsibility is reflected in our Audit Committee charter. Our Audit Committee receives quarterly updates from our chief information security officer on the status of these programs. Our Audit Committee also receives a detailed presentation from our chief information security officer on our cybersecurity program annually, which includes the results of an external third-party assessment. Our Audit Committee is comprised solely of independent directors, with one member who is a subject matter expert in technology and cybersecurity.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats, and has appointed a chief information security officer to lead our global cybersecurity organization for this purpose. Our executive management team and key members of our broader finance, legal, tech and operations organizations receive detailed monthly briefings from our chief information security officer on the status of our cybersecurity program and our readiness to prevent, detect, mitigate and recover from cybersecurity incidents.


text: Our chief information security officers leads our incident response team for addressing and recovering from identified cybersecurity incidents. Our incident response team includes key members of our tech, legal and executive management teams to manage our response efforts, which includes timely compliance with applicable contractual and regulatory notification obligations.


text: Risk Management and Strategy We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 19 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 17 years with NVR in progressively more senior information security roles.

companyName: NVR INC

ticker: NVR


text: Significant information technology processes that have been implemented include: - vulnerability management to help ensure security updates are effectively applied, - utilization of encryption and multi-factor authentication technologies to protect company data, - regular required training for all employees with systems access regarding matters such as cybersecurity threats and data protection, and utilization of simulated phishing tests to increase security awareness, - regular review of third-party service providers, including review of their system and organization controls (SOC) reports, - enhanced monitoring capabilities for early detection and rapid response to potential security anomalies, - documented incident response readiness process updated annually, - completion of tabletop exercises on potential cybersecurity breaches with the assistance of a third-party cybersecurity consultant, and - regular review of information technology disaster recovery and business continuity processes to help ensure the ability to resume work after an incident.


text: Review of these processes has been incorporated into our annual risk assessment and internal audits of controls performed by our Internal Audit department. Results of these audits are reported to the Audit Committee by our Vice President of Internal Audit and Corporate Governance.


text: As previously discussed in Item 1A of this Form 10-K "Risk Factors", failure to maintain the security of the data we are required to protect could have a material adverse effect on our operations and financial results. We currently do not believe that any current cybersecurity threats have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition.


text: Our Audit Committee is required under its charter to periodically review our data privacy and information security programs. Our Audit Committee assists our Board in oversight and monitoring of our cybersecurity processes, including systems to collect and store confidential information, ongoing initiatives, current threats and our response readiness to cybersecurity attacks.


text: Our CIO and CISO communicate directly with members of the Audit Committee and Board of Directors on cybersecurity matters. In 2023, our CIO and CISO presented updates on our cybersecurity initiatives quarterly; twice to our Audit Committee and twice to our full Board.


text: Risk Management and Strategy We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 20 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 18 years with NVR in progressively more senior information security roles.


text: Our CIO and CISO communicate directly with members of the Audit Committee and Board of Directors on cybersecurity matters. In 2024, our CIO and CISO presented updates on our cybersecurity initiatives quarterly; twice to our Audit Committee and twice to our full Board.


text: Addressing cybersecurity risks is a priority for us. We have in place systems of internal controls as well as business continuity and disaster recovery plans, and we regularly perform assessments of these systems and plans to address cybersecurity and technology. Our cybersecurity program has been developed based on industry standards set by the National Institute of Standards and Technology ("NIST") and includes a comprehensive set of security policies and procedures that guide our protection strategy against threats by utilizing the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls, and remediation practices; implementing a third-party risk management program to evaluate our cyber position; and, evaluating our cybersecurity program effectiveness by performing both internal and external testing and auditing risk. In addition to a dedicated information technology cybersecurity team monitoring our daily operations, we annually assess our cybersecurity program against the NIST framework and engage outside security firms to conduct penetration tests and assist with monitoring of daily operations. We require annual cybersecurity awareness training for all of our employees to aid in promptly identifying and reporting potential or actual issues. Additionally, our dedicated information technology cybersecurity team undertakes regular robust cybersecurity training to increase cybersecurity awareness, internal expertise, and readiness efforts. We install and regularly update antivirus software on all Company managed systems and workstations in an effort to detect and prevent malicious code. We conduct ongoing security breach and phishing simulations to raise awareness of various critical security threats. Periodically, we run tabletop exercises involving members of the Company's management team intended to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures. All third-party service providers or vendors utilized as part of the Company's cybersecurity framework are required to comply with our policies regarding non-public personal information and information security.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: Our cybersecurity program is led by our Senior Vice President - Strategic Services and Chief Information Officer ("CIO"). Our CIO also serves as the Chair of our Cybersecurity Executive Oversight Committee ("CEOC"), comprised of senior executives representing various teams and functions of the Company including legal, finance, accounting, investor relations, and operations. The CEOC supports efforts to evaluate the materiality of any incidents, determines whether notice to third parties such as residents or vendors is required, and determine whether any disclosures to stakeholders are required. The CEOC is also responsible for ensuring the Company's management and Board of Trust Managers ("Board") are fully aware of key activities and events associated with our cybersecurity program on an ongoing basis.


text: Although our entire Board is actively involved in overseeing risk management, the Audit Committee charter tasks the Audit Committee with providing oversight of management's guidelines and policies to govern the process by which risk assessments and risks are managed, including the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee also discusses with management the processes undertaken to evaluate our systems of disclosure controls and procedures, including those relating to cybersecurity risk management. Our CIO reports quarterly to the Audit Committee and Board regarding cybersecurity matters, which includes emerging cybersecurity threats and the risk landscape, updates on our cybersecurity program and related readiness, resiliency, and response efforts.


text: Like other businesses, we have been, and expect to continue to be, subject to attempts on unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, we have not experienced a cybersecurity breach nor are we aware of any of our third-party outside service providers experiencing a cybersecurity breach.


text: Addressing cybersecurity risks is a priority for us. We have in place systems of internal controls as well as business continuity and disaster recovery plans, and we regularly perform assessments of these systems and plans to address cybersecurity and technology. Our cybersecurity program has been developed based on industry standards set by the National Institute of Standards and Technology ("NIST") and includes a comprehensive set of security policies and procedures which guide our protection strategy against threats by utilizing the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls, and remediation practices; implementing a third-party risk management program to evaluate our cyber position; and, evaluating our cybersecurity program effectiveness by auditing risk and performing both internal and external testing. In addition to a dedicated information technology cybersecurity team monitoring our daily operations, we annually assess our cybersecurity program against the NIST framework and engage outside security firms to conduct penetration tests and assist with monitoring of daily operations. We require annual cybersecurity awareness training for all of our employees to aid in promptly identifying and reporting potential or actual issues. Additionally, our dedicated information technology cybersecurity team undertakes regular robust cybersecurity training to increase cybersecurity awareness, internal expertise, and readiness efforts. We install and regularly update antivirus software on all Company managed systems and workstations in an effort to detect and prevent malicious code. We conduct ongoing security breach and phishing simulations to raise awareness of various critical security threats. Periodically, we run tabletop exercises involving members of the Company's management team intended to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures. In addition to these procedures we have in place, we also maintain cybersecurity insurance to cover certain losses and damages caused by a cybersecurity incident. All third-party service providers or vendors utilized as part of the Company's cybersecurity framework are required to comply with our policies regarding non-public personal information and information security.


text: Our cybersecurity program is led by our Senior Vice President - Strategic Services and Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO also serves as the Chair of our Cybersecurity Executive Oversight Committee ("CEOC"), comprised of our CISO and other senior executives representing various teams and functions of the Company including legal, finance, accounting, investor relations, and operations. The CEOC supports efforts to evaluate the materiality of any incidents, determines whether notice to third parties such as residents or vendors is required, and determines whether any disclosures to stakeholders are required. The CEOC is also responsible for ensuring the Company's management and Board of Trust Managers ("Board") are fully aware of key activities and events associated with our cybersecurity program on an ongoing basis.


text: Our entire Board is actively involved in overseeing risk management and the Audit Committee Charter tasks the Audit Committee with providing oversight of management's guidelines and policies to govern the process by which risk assessments and risks are managed, including the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee also discusses with management the processes undertaken to evaluate our systems of disclosure controls and procedures, including those relating to cybersecurity risk management. Our CIO reports quarterly to the Audit Committee and Board regarding cybersecurity matters, which includes emerging cybersecurity threats and the risk landscape as well as updates on our cybersecurity program and related readiness, resiliency, and response efforts.


text: Like other businesses, we have been, and expect to continue to be, subject to attempts on unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks, and intrusions and other events of varying degrees. To date, we have not experienced a material cybersecurity incident nor are we aware of any of our third-party outside service providers experiencing such an incident.


text: For a discussion on certain of the Company's cybersecurity-related risks, see Item 1A under the heading "Risk Factors-Risks Associated with Our Operations - A cybersecurity incident and other technology disruptions could negatively impact our business. "


text: The Company maintains a documented information security program, under the supervision of its Chief Information Officer ("CIO"), that is designed to protect the infrastructure, information systems, and the information in Company systems from unauthorized access, use, or other malicious acts by enabling the organization to identify risks, implement protections, and detect and respond to cybersecurity events. Our information security program covers multiple aspects of security management, including, but not limited to: data handling and classification; user access controls and management; business continuity and disaster recovery; configuration management; asset management; risk assessments; data disposal; record retention; information security incident response; vulnerability and patch management; network security and monitoring; physical and environmental controls; data privacy; vendor and third party risk management; multi-factor authentication; and cybersecurity awareness training. The CIO has over 25 years of professional, cross-discipline information technology experience in various industries including real estate, financial services, government, and hospitality. The Vice President of Cybersecurity, reporting directly to the CIO, has over 18 years of information technology experience and is a Certified Information Systems Security Professional ("CISSP"). Both have been with the Company for over a decade.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: The Company performs an annual risk assessment that includes identifying, assessing and documenting how cybersecurity and privacy risks are evaluated; establishes criteria to evaluate the confidentiality, integrity, and availability of Company systems and nonpublic information; documents how existing controls address identified risks; and leads to the revision of controls as appropriate. In addition, dedicated information technology and executive personnel convene quarterly to examine operational aspects of cybersecurity.


text: The Company maintains an incident response plan that is designed to quickly respond to cyber security related incidents in a manner that protects its own information and the information of the Company's customers and tenants as outlined in the incident response plan. The incident response plan establishes a primary incident coordinator, incident response teams, workstreams, escalation paths, and contacts to be engaged in an incident. The Company conducts scheduled tests of its incident response plan to verify that the teams understand how to respond to cyber threat scenarios.


text: The Company contracts with third parties to periodically conduct penetration testing. The Company's internal audit team also periodically conducts a risk-based cybersecurity audit and, as part of such audit, engages third parties to conduct detailed security assessments, including adversary simulations, technical remediation validation and reporting of results. The Company's internal audit team prepares cybersecurity audit reports in accordance with appropriate standards and reports findings and recommendations to Company management. The audit reports and management's responses, including descriptions of any corrective actions taken, are then reported to the Audit Committee and the Board of Directors. Cybersecurity threats, possible security events, and ongoing security enhancement initiatives are regularly discussed and tracked with the CIO, VP of Cybersecurity, and other senior IT team members through regularly scheduled, collaborative meetings and more frequently as the subject matter merits. Preventative security measures are shared with Management through regularly scheduled IT steering committee meetings. The Audit Committee is apprised of cybersecurity controls, known and perceived risks, remediation of those risks, and other measures via the Chief Audit Executive, through direct briefings, or in writing (by the CIO and/or designee). Our incident response policy/plan requires that key Company executives and the Audit Committee are informed of and involved with any confirmed cybersecurity incident (including mitigation/remediation). Company IT acceptable use policies require that employees report any security incidents to IT and his/her supervisor. Regularly scheduled Company training courses and security bulletins reinforce security awareness.


text: The Company has designed a third-party risk management program, under the supervision of its Chief Data Privacy Officer, that is designed to manage third-party providers through the lifecycle of the relationship. This includes assessing the vendors based upon their criticality and inherent risk, analyzing the risk posed, performing due diligence prior to contract execution, and conducting annual monitoring of risk and performance. Due diligence activities include an assessment of the minimum cybersecurity controls (specifically, data handling practices, encryption, and cybersecurity event management) to enable the Company to verify that third-party controls meet our expectations and contractual commitments.


text: Cybersecurity processes have been integrated into the Company's broader framework of risk management. The Company's Board of Directors exercises oversight of cybersecurity risks. The Board of Directors entrusts the Audit Committee with responsibility for regularly reviewing and assessing cybersecurity risks to ensure a proactive approach to safeguarding the Company's digital assets. The Audit Committee's primary role is to provide an independent and objective assessment of the Company's cybersecurity risk management practices to confirm that they are both effective and aligned with the Company's strategic objectives. The Audit Committee also reports its findings and recommendations to the Board of Directors, helping the Board of Directors to make informed decisions regarding cybersecurity strategy, investments, and risk. Notwithstanding the Company's efforts, the Company is aware that preventative measures cannot prevent all cybersecurity incidents. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."


text: Cybersecurity processes have been integrated into the Company's broader framework of risk management. The Company's Board of Directors exercises oversight of cybersecurity risks. T he Board of Directors entrusts the Audit Committee with responsibility for regularly reviewing and assessing cybersecurity risks to ensure a proactive approach to safeguarding the Company's digital assets. The Audit Committee's primary role is to provide an independent and objective assessment of the Company's cybersecurity risk management practices to confirm that they are both effective and aligned with the Company's strategic objectives. The Audit Committee also reports its findings and recommendations to the Board of Directors, helping the Board of Directors to make informed decisions regarding cybersecurity strategy, investments, and risk. Notwithstanding the Company's efforts, the Company is aware that preventative measures cannot prevent all cybersecurity incidents. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."


text: Information Security Program Pathward maintains a comprehensive Information Security Program to promote the principles of sound information security governance and to ensure risk-taking activities are in line with the Company's strategic objectives, risk appetite, and regulatory requirements. The Information Security Program governs the confidentiality, integrity, and availability of data, and defines the responsibilities of departments and individuals for such data. The Information Security Program is designed to protect information resources from a wide range of threats to ensure business continuity and minimize business risk.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Risk Management and Strategy The goal of the Information Security Program is to prevent cybersecurity incidents. The Information Security Program aligns to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Information Security Policy is designed to address compliance by Pathward and its personnel with applicable laws and regulations. Information security controls are designed to follow the Center for Internet Security ("CIS") controls framework. Policies and program standards that align with CIS and Payment Card Industry Data Security Standard ("PCI-DSS") are also in place.


text: The Information Security teams include experienced, highly qualified architects, engineers and analysts who support all aspects of cybersecurity including security architecture, identity and access management, vulnerability management, security operations, as well as governance, risk and compliance. The majority of the Information Security staff holds at least one cybersecurity-related certification.


text: Pathward has a formal Enterprise Risk Management ("ERM") department. The Company's Chief Risk Officer is responsible for developing and executing the risk framework and ERM plan for the Company. The Company has implemented a three lines of defense model. The first line of defense ("1LOD") is responsible for owning, measuring, and managing the risks and controls. The second line of defense ("2LOD") is responsible for monitoring risk and controls in support of management. The third line of defense ("3LOD") is the independent audit function.


text: Based on the risk appetite of the Company, the ERM department monitors enterprise-wide risk and control profiles. The ERM department provides monthly and quarterly risk reporting to management and the Board of Directors. The ERM department ensures accurate and timely risk assessments are prepared throughout the organization. The ERM department and compliance team also administer a documented regulatory change control process when new and revised regulations need to be implemented.


text: Role of Management Pathward's Information Security Program is managed by the Company's Chief Product and Technology Officer ("CPTO") and Chief Information Security Officer ("CISO"). The current CPTO has over 30 years of experience in senior leadership positions in the areas of information technology, technology innovation and enterprise architecture, and has been recognized for various technology and leadership awards. The current CISO reports to the CPTO and has extensive years of experience in information security both at Pathward and at other companies as well as many years of executive management experience. The CISO regularly reports to executive management, the Risk Committee of the Board of Directors (the "Board Risk Committee") and the Board of Directors regarding all aspects of information security including cybersecurity risk and incidents. The Information Technology Committee and Executive Risk Committee provide governance and oversight of the Information Security Program. These Committees convene at least four times annually, reporting significant activities and issues upward to the Board Risk Committee and the Board of Directors as necessary.


text: Role of the Board of Directors The Board of Directors has delegated oversight of all enterprise risks relevant to the Company, including information technology and cybersecurity risk, to the Board Risk Committee, which consists of three independent non-employee directors. The CISO provides quarterly updates on information security and cybersecurity risk to the Board Risk Committee, as well as an annual cybersecurity overview and information security report to the full Board of Directors. The Risk Committee oversees the Information Security Program including through the annual review and approval of any material changes to the Information Security Policy.


text: Security Awareness Training All Pathward employees play a crucial role in cybersecurity defense. Pathward has implemented a security awareness training program that includes annual mandatory training for employees and contractors as well as ongoing phishing resiliency testing. The security awareness program also includes periodic videos and educational articles that are shared with employees through a partnership with corporate communications.


text: Third Party Risk Management Program The Information Security third party risk management program is a piece of the overarching enterprise third party risk management program. The Information Security team's reviews of third parties include initial and periodic security assessments, documentation and audit report reviews, and consultation on any security enhancements recommended based on the results of the completed reviews.


text: Incident Response Program Management has developed and implemented a risk-based incident response program to minimize the impact to Pathward and its customers in the event of an information security incident. The incident response program has defined protocols to declare and respond to an identified incident and includes appropriate containment and restoration strategies. Pathward maintains a documented Cybersecurity Incident Response Plan and has identified Information Technology and Information Security staff who are responsible for assisting with a data breach incident response event. Team members have defined roles, responsibilities and must participate in incident response training and walk-through events at least annually. Pathward has contracted with an incident response provider in the event of a security breach. In addition, Pathward has acquired a cybersecurity insurance policy.


text: Pathward has established a Crisis Management Team ("CMT"), which is comprised of executive leadership and key senior stakeholders and is engaged immediately following a cybersecurity incident. The CMT provides leadership and maintains ultimate executive level oversight during each phase of the incident.


text: Pathward has robust cybersecurity measures in place. Pathward is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pathward, including its business strategy, results of operations or financial condition, during the fiscal year ended September 30, 2024. Yet, in this modern, evolving world cybersecurity remains a high risk regardless. For further information about the cybersecurity risks Pathward faces, and potential impacts, see Item 1A. "Risk Factors".


text: Role of Management Pathward's Information Security Program is managed by the Company's Chief Information and Operations Officer ("CIOO") and Chief Information Security Officer ("CISO"). The current CIOO has over 30 years of experience in senior leadership positions in the areas of information technology, technology innovation and enterprise architecture, and has been recognized for various technology and leadership awards. The current CISO reports to the CIOO and has extensive years of experience in information security both at Pathward and at other companies as well as many years of executive management experience. The CISO regularly reports to executive management, the Risk Committee of the Board of Directors (the "Board Risk Committee") and the Board of Directors regarding all aspects of information security including cybersecurity risk and incidents. The Information Technology Committee and Executive Risk Committee provide governance and oversight of the Information Security Program. These Committees convene at least four times annually, reporting significant activities and issues upward to the Board Risk Committee and the Board of Directors as necessary.


text: Pathward has robust cybersecurity measures in place. Pathward is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pathward, including its business strategy, results of operations or financial condition, during the fiscal year ended September 30, 2025. Yet, in this modern, evolving world cybersecurity remains a high risk regardless. For further information about the cybersecurity risks Pathward faces, and potential impacts, see Item 1A. "Risk Factors".


text: BorgWarner's Board of Directors acknowledges the importance of upholding the trust and confidence of its customers, business partners, employees and other stakeholders. The Board, in conjunction with the Audit Committee, is involved in the oversight of the Company's risk management program, including its Cybersecurity Program. The Cybersecurity Program is managed by the Chief Information Officer ("CIO"), whose information technology ("IT") team is responsible for enterprise-wide information technology, including cybersecurity strategy, policy, standards, architecture and processes. The Cybersecurity Program, including its standards, processes and practices, is benchmarked against recognized cybersecurity frameworks. The Cybersecurity Program continually enhances the enterprise security structure and contingency plans with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing the organization system resilience to minimize the business impact should an incident occur.

companyName: BORGWARNER INC

ticker: BWA


text: Risk Management and Strategy Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. The Cybersecurity Program has various tools and programs in place to monitor and address potential threats and incidents impacting the Company's operations and to determine the materiality of and ensure timely public disclosure of such threat or incident, if appropriate.


text: Technical Safeguards: The Company deploys technical safeguards designed to protect the Company's information systems from cybersecurity threats. The Company deploys tools in an effort to detect vulnerabilities, and when a weakness is identified, the Company seeks to assess the significance of the impact and mitigate before the weakness is exploited by an unauthorized actor.


text: Incident Response and Recovery Plan: The Company has an incident response and recovery plan, which details the steps to be taken from the initial internal reporting of a potential cybersecurity incident.


text: Third-Party Risk Management: The Company is developing processes and procedures to identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems.


text: Education and Awareness: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Company's Cybersecurity Program, including applicable policies, standards, processes and practices.


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Company's Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.


text: The Cybersecurity Program and related initiatives are managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct the assessment, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: BorgWarner's Board of Directors acknowledges the importance of upholding the trust and confidence of BorgWarner's customers, business partners, employees and other stakeholders. The Board, in conjunction with the Audit Committee, is involved in the oversight of the Company's risk management program, including its Cybersecurity Program. The Cybersecurity Program is managed by the Chief Information Officer ("CIO"), whose information technology ("IT") team is responsible for enterprise-wide information technology, including cybersecurity strategy, policy, standards, architecture and processes. The Company benchmarks the Cybersecurity Program, including its standards, processes and practices, against recognized cybersecurity frameworks. The Cybersecurity Program continually enhances the enterprise security structure and contingency plans with the goal of preventing cybersecurity incidents to the extent feasible and minimizing the business impact should an incident occur.


text: Third-Party Risk Management: The Company continues to review processes and procedures that identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems. In December 2024, the Company updated its indirect Purchase Order Terms and Conditions, effective January 1, 2025, to address (i) supplier cybersecurity incident notification requirements and (ii) the Company's right to audit supplier IT systems.


text: Education and Awareness: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Cybersecurity Program, including applicable policies, standards, processes and practices.


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Cybersecurity Program, recent developments, evolving standards and emerging threats or trends within cybersecurity. The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.


text: The Cybersecurity Program is managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct assessments, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cybersecurity Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: In addition, all employees of the Company and CIM Group receive mandatory training on cybersecurity matters upon hiring and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cybersecurity incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") and representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM Group's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Transformation, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.


text: Risk Management and Strategy As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at both a technical and management level.


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on an annual basis, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide specialized security training for certain employee roles, such as application developers. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services; and Mandiant to augment our incident response ability and provide forensic services. We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our cyber insurance policies and assesses whether we have appropriate coverage.


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. That said, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our Chief Product and Technology Officer, Chief Information Security Officer and the Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. In addition, the Board receives separate presentations on cybersecurity risk from our Chief Product and Technology Officer. Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our Chief Product and Technology Officer and approves our technology strategic plan.


text: Role of management Our Chief Information Security Officer, together with our Chief Product and Technology Officer and Chief Information Officer, is responsible for the day-to-day management of our cybersecurity risks. We have established a Security Council, which includes our Chief Executive Officer, Chief Commercial Officer, Chief Product and Technology Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Chief Information Security Officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.


text: Our Chief Information Security Officer, Chief Product and Technology Officer and Chief Information Officer each have extensive experience in the information technology area. In particular, our Chief Information Security Officer has over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC; our Chief Product and Technology Officer has twenty eight years of professional experience in the information security area; and our Chief Information Officer has twenty three years of professional experience in the information security area.


text: Risk Management and Strategy As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing us, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a reasonable and comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at technical, management and executive levels.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services and augment our incident response ability. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our insurance policies and assesses whether we have appropriate coverage.


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. As discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.