text: The VP, Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: The VP, Information Technology has been with our Company for over five years in the roles of Director, Global IT Engineering & Sr Director, Global IT Engineering. Prior to joining our Company, the VP, Information Technology was the founder, President and CEO of RjR Innovations, a North American industry leader in IT Service Management. Throughout his 27-year career within the Information Technology industry, he has been an ITIL Best Practice Conference Speaker & Keynote Speaker at several events. The VP, Information Technology is supported by the Senior Director Cybersecurity & IT Risk who has over ten years in a senior cybersecurity leadership role. He holds certifications in CISM (Certified Information Security Manager) from ISACA and PCIP (Payment Card Industry Professional) from the PCI Security Standards Council.

companyName: Canopy Growth Corp

ticker: CGC

secItem: Item 1C


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, have not materially affected and are not reasonably likely to materially impact our operations materially, including our business strategy, results of operations, or financial condition.


text: Cybersecurity incidents are inevitable in the current threat environment. We believe that it is a question of "when" not "if" a cybersecurity incident will occur. As a result, we commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents, including the amount of information that can be extracted from our systems by threat actors, whether internal or external.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: We take a cross-departmental approach to addressing cybersecurity risk, which includes input from senior management, our Cybersecurity Council (a taskforce comprised of representatives from primary corporate functions across our Moving and Storage, Property and Casualty Insurance, and Life Insurance subsidiaries), other team members, and oversight by the Board and its Audit & Cyber Committee. We commit resources to cybersecurity and risk management processes to analyze the changing cybersecurity landscape and respond to ongoing and emerging threats. We monitor and assess the threat landscape on an ongoing basis. Our Cybersecurity Council reviews cybersecurity risks. In addition, we have a set of Company-wide policies and procedures that directly or indirectly relate to cybersecurity. These policies go through an internal review process and are approved by members of management.


text: The Company's Director, Data Privacy & Security leads the IT security team and is responsible for coordinating and implementing our information security program. The Director, Data Privacy and Security also reports on cybersecurity matters to senior management and informs on such matters to the Audit & Cyber Committee of the Board. IT security team members have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we perform simulations and tabletop exercises with members of the Cybersecurity Council and other team members involved in incident response. We involve external resources and advisors as needed. Team members have on-demand online access to cybersecurity training through our online U-Haul University.


text: We have expanded investments in IT security and improved access control and identity and authentication management, and engage consultants as needed. We test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party consultants. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, mitigation, and remediation. The cybersecurity team collects data on cybersecurity threats and risk areas and conducts risk assessments. We conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of our third-party service providers. Our assessment of risks associated with our use of third-party service providers is part of our overall cybersecurity risk management framework.


text: The Audit & Cyber Committee and the full Board participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit & Cyber Committee reviews the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, recent enhancements to the Company's defenses, and management's progress on its cybersecurity initiatives. In addition, the Board and the Audit & Cyber Committee discuss recent threats and how the Company is managing those threats.


text: Despite our work to identify and address cybersecurity risks, we experience threats to our data and systems. We have experienced cybersecurity incidents in the past, including breaches of our data and systems. To date, none of those cybersecurity incidents has resulted in a material impact on our business strategy, results of operations or financial condition. However, the impacts of cybersecurity incidents in the future could be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents are inevitable, and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us" in Item 1A- Risk Factors in this Annual Report.


text: We believe cybersecurity is critical to advancing our technological advancements. As a clinical stage biotechnology company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks and have developed our own practices and framework, which we believe enhance our ability to identify and manage cybersecurity risks. Our Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The IT Risk Committee and our cybersecurity consultant, which has extensive information technology and program management experience, regularly brief the Audit Committee on our cybersecurity and information security posture and the Audit Committee is apprised of any cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Audit Committee retains oversight of cybersecurity because of its importance. In the event of any incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Audit Committee, as appropriate.


text: As a clinical stage biotechnology company, we must also comply with extensive regulations, including requirements imposed by the U.S. Food and Drug Administration related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet SEC disclosure requirements. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We will require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors" for a discussion of cybersecurity risks, including, without limitation, the risk factor under the heading "We may be subject to security breaches or other cybersecurity incidents that could compromise our information and expose us to liability". Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Risk management and strategy Our cybersecurity program is designed to safeguard our information systems and protect confidentiality, integrity, and availability of those information systems and the information residing therein. Our cybersecurity risk management program is integrated with our broader enterprise risk management programs under the oversight of our Chief Administrative Officer ("CAO") and the Enterprise Risk Management Committee. The CAO reports to the CEO and is responsible for our overall information and data security strategy, cybersecurity risk policies and procedures, as well as evaluating and managing any material risks from cyber threats. Our Chief Information Security Officer ("CISO") reports directly to our CAO and leads our cybersecurity and compliance department.

companyName: TRIUMPH GROUP INC


text: The cybersecurity and compliance department, in conjunction with our Computer Security Incident Response Team ("CSIRT"), designs, implements, and executes continuous monitoring processes for our information systems. Our monitoring programs include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CSIRT is responsible for the detection and assessment of cybersecurity threats and incidents in accordance with a formal risk assessment matrix established in cooperation with our Cybersecurity Disclosure Committee. This risk assessment matrix establishes a framework for notification of an incident to the Cybersecurity Disclosure Committee and, if appropriate, the Audit Committee or Board of Directors. The CISO also partners with internal functions such as finance, legal, and internal audit, as well as third-party consultants who perform risk-based assessments against the National Institute of Standards and Technology ("NIST") 800-171 Rev2 and Cybersecurity Maturity Model Certification with recommendations, in designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategy, helping ensure such programs and strategy align with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee or Board of Directors.


text: In the event of a cybersecurity incident, the CSIRT has an Incident Response Plan that outlines the steps that are designed to help ensure regulatory requirements are met and cyber vulnerabilities, if any, are addressed. We periodically conduct "tabletop" exercises to simulate cybersecurity incidents and help ensure that we are prepared to respond to such incidents in accordance with our internal policies and programs, as well as applicable laws and regulations. In addition, tabletop exercises allow us to identify areas for potential improvement and maturation of our Incident Response Plan, or other aspects of our cybersecurity risk management program. These exercises have included participation by members of our Cybersecurity Disclosure Committee, including our CAO and Chief Financial Officer.


text: We have established a supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to assess and evolve our oversight processes to mature how we manage cybersecurity risks associated with the products and services we procure. We generally require our suppliers to adopt security practices based on industry-recognized standards.


text: We have experienced, and may experience in the future, either directly or through our supply chain or other channels, cybersecurity incidents. To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks associated with cybersecurity, refer to "Our business could be negatively affected by cyber or other security threats or other disruptions" in Item 1A. Risk Factors.


text: Our Board of Directors has overall responsibility for risk oversight and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee reports on its activities, findings, and other matters to the full Board of Directors quarterly, or more frequently as events or circumstances may require. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The CAO and CISO present an update to the Audit Committee on our cybersecurity risks and risk management strategies and processes at each regularly scheduled, quarterly meeting. These presentations include assessments on the threat landscape; emerging risks, threats, or vulnerabilities; updates on our risk management activities, including investments in risk mitigation and governance; compliance with laws and regulations; internal controls; and updates on incidents.


text: At the management level, we have established two committees that are directly involved in managing and responding to cybersecurity risks and incidents: the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee. The Enterprise Risk Management Committee is responsible for assessing enterprise risk and overseeing our enterprise risk management programs, including the cybersecurity risk management programs described above. The Cybersecurity Disclosure Committee is a subcommittee of our Disclosure Committee and is responsible for assessing the materiality of identified cybersecurity incidents resulting from our monitoring programs described above and informing the Chair of the Audit Committee, the Audit Committee, or the Board of Directors, as appropriate. The CISO has responsibility for notifying the CAO and the Cybersecurity Disclosure Committee of potentially material cybersecurity incidents based on an established policy and risk assessment matrix that incorporates an evaluation of quantitative and qualitative factors such as potential impact on results of operations and financial condition, compliance with laws and regulations, and impact on key stakeholders such as employees and business partners. The CISO has over fifteen years of cybersecurity risk management experience and has served the Company for over twenty years in various roles involving managing information technology, security and compliance functions, including developing key enterprise capabilities such as security engineering and strategies on information security risk management.


text: The CAO and Chief Financial Officer are members of both the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee and are supported by our information security, compliance, contracts, treasury, investor relations, operations, and supply chain organizations so that identified issues can be addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Cybersecurity is one of the top operational risks facing TMCC. We and other financial institutions continue to be targets of ever evolving cybersecurity threats and cyberattacks. As a result, we devote significant resources to a cybersecurity program designed to minimize such risks and protect TMCC, along with data from our customers and clients.

companyName: TOYOTA MOTOR CREDIT CORP


text: Cybersecurity Risk Management and Strategy TMCC's cybersecurity program is designed to identify and assess internal and external cybersecurity threats to and within TMCC's business and operations and to take action aimed at protecting the Company, mitigating and managing cybersecurity risk, and in time of attack, to respond expeditiously to minimize the impact of the attack.


text: Managing cybersecurity threats is a component of our broader enterprise risk management program, which establishes a risk management framework that seeks to identify, assess, and monitor risks that could materially impact our business, customers, clients, employees and stakeholders.


text: TMCC's cybersecurity program utilizes a variety of controls that are designed to identify, prevent, detect, respond to, and recover from cybersecurity threats and events. Those processes and controls include: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity risk policies and standards, implementing controls, monitoring the environment, and responding to cybersecurity incidents; • periodic cybersecurity awareness training for employees and contractors on our policies and emerging cybersecurity threats, including phishing awareness; • internal and independent cybersecurity testing, including penetration testing and tabletop exercises, to assess vulnerabilities of our information systems and evaluate our cyber defense capabilities, technical safeguards and resiliency; • identifying and managing cybersecurity risk of our critical third-party suppliers; • periodic cybersecurity risk assessments for our information systems and applications; • cybersecurity monitoring and response processes employing cross functional teams to identify, assess, escalate, investigate, contain, and remediate incidents; and • incident response and recovery plans.


text: As part of TMCC's cybersecurity program, TMCC engages with assessors and third-party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: TMCC's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third-party service providers with access to TMCC's systems and data, as well as such third-party service providers' adherence to certain cybersecurity standards and processes. As appropriate, TMCC requires such third-party service providers to agree to be subject to cybersecurity evaluations by TMCC.


text: Although, we and our third-party service providers have experienced cybersecurity incidents, which have resulted in adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. However, we expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."


text: Cybersecurity Governance The Board of Directors (the "Board") has risk oversight responsibility for the cybersecurity and data privacy risk management programs of TMCC, which are administered directly and with assistance from the Cybersecurity Committee of the Board.


text: The purpose of the Cybersecurity Committee is to assist the Board in fulfilling its oversight responsibility with respect to its information technology use and protection, including enterprise cybersecurity and data privacy, among other things. The Cybersecurity Committee receives, reviews, and discusses reports from members of management, as appropriate or required by law, including but not limited to the Chief Information Officer, Chief Information Security Officer, Chief Risk Officer, Chief Legal, Compliance and Administrative Officer, and other officers or employees as appropriate, regarding TMCC's practices, management and functioning of technology operations and information security, cybersecurity and data privacy risks. The Cybersecurity Committee reports to the Board regarding its activities, its receipt of reports regarding material cybersecurity and data privacy issues, material issues found in vulnerability assessments or penetration testing, and reports from the Chief Information Officer and Chief Information Security Officer.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: TMCC's cybersecurity program is administered by our Chief Information Security Officer. We believe our Chief Information Security Officer and our information security team have the appropriate expertise, background, and depth of experience to manage cybersecurity and data privacy risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, information security leadership roles, military experience, academia, ongoing internal and external training, and regular discussions with consultants and industry peers with applicable knowledge and expertise regarding emerging cybersecurity threats.


text: When a cybersecurity threat or incident is identified, the Chief Information Security Officer works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, the Cybersecurity Committee, and the Board, as necessary, regarding significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, employees and stakeholders, and continues to provide regular reports until such incidents are concluded.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for Barber-Nichols ("BN"). Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: Our CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment including risks associated with ransomware; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: We may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.


text: Our Audit Committee, through their responsibilities designated to them in the Audit Committee Charter, oversees cybersecurity risk management as part of its risk oversight function and oversees management's implementation of our CRMP.


text: The Audit Committee receives periodic reports from management and the IT Managers for Graham Corporation and BN on our cybersecurity risks at least annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Senior IT Manager and IT Manager regularly inform our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.


text: Risk Management and Strategy The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices, which are integrated into the Company's overall risk management system. To protect the Company's information systems from cybersecurity threats, the Company uses various security technologies and tools that help the Company identify, escalate, investigate, manage, resolve and recover from security incidents in a timely manner. These efforts include: • ongoing collection of threat intelligence and environment awareness through monitoring, • data protection management and vulnerability monitoring through data loss prevention and exfiltration tools, • cybersecurity risk management processes and practices, • control assurance, • secure development of new products, • identity and access management, • incident response, auditing and monitoring, and • maintaining a 24x7 security operations center to allow for always available incident response.

companyName: NetApp, Inc.

ticker: NTAP


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into our incident and risk management processes. In the event we identify a cybersecurity incident, our senior management, consisting of the Chief Financial Officer, Chief Security Officer (CSO), and Chief Legal Officer, review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.


text: The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engages third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services or occurs on our systems, within our supply chain, or on our end-user customer systems, or if stored data is improperly accessed, customers may reduce or cease using our solutions, our reputation may be harmed and we may incur significant liabilities."


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CSO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the company, related metrics, and any incidents or issues that require attention from the Board of Directors.


text: The CSO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.


text: NetApp's CSO, in coordination with the Chief Information Security Officer (CISO) is responsible for leading the assessment and management of cybersecurity risks. The current CSO and CISO each have over 30 years of experience in IT and information security.


text: The CSO and CISO stay informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.


text: Our Board of Directors and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee of the board on a quarterly basis reviews cybersecurity risks and our board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. The board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, the board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining limited access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Operational Risks."


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including conducting scans of the threat environment and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats, including risk assessments, incident detection and response, end-point detection and response, network security controls, access controls, physical security, systems monitoring, a vendor risk management program, and penetration testing. We work with third parties (including professional services firms, threat intelligence service providers, and penetration testing firms) from time to time that assist us to identify, assess, and manage cybersecurity risks.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Our information security team reviews enterprise level cybersecurity risks at least annually, and key cybersecurity risks are identified, tracked, monitored, and addressed in alignment with our overall enterprise risk management program.


text: We utilize third-party service providers to perform certain business functions. We seek to engage reliable and reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we may review the cybersecurity practices of such provider, contractually impose obligations on the provider, conduct information security risk assessments, and conduct periodic reassessments during their engagement.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cyber-security risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Audit Committee is responsible for overseeing risks from cybersecurity threats, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from our Vice President – Information Technology (Chief Information Officer) concerning our significant cybersecurity threats and risks, and the processes we have implemented to address them.


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Vice President – Information Technology (Chief Information Officer) is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. Beginning in fiscal 2024, this team began meeting monthly to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.


text: We view cybersecurity threats as a shared responsibility. All new employees with company email addresses receive cybersecurity training as part of their onboarding, as well as annual training. We also periodically publish a cybersecurity newsletter to these employees related to topics such as phishing, social engineering, and insider-threat awareness.


text: Our overall information security risk management approach is designed to enable us to assess, identify and manage major risk exposures, including from material risks from cybersecurity threats, in a timely manner. As part of our information security risk management program, we perform risk assessments in which we map and prioritize information security risks identified through the processes described below. These assessments inform our information security risk management strategies and oversight processes and we view cybersecurity risks as one of the key risk categories we face.

companyName: ORACLE CORP

ticker: ORCL


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems. During fiscal 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, if a cyberattack or other security incident results in unauthorized access to or modification or exfiltration of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.


text: Our corporate security and information security programs are designed to help us prevent, prepare for, detect, respond to and recover from cybersecurity threats. We leverage industry standard security frameworks to evaluate our security controls. Relevant personnel collaborate with subject matter experts throughout the process to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate a potential security incident. We continually conduct security and privacy reviews to pinpoint risks associated with our products, services and enterprise. We also employ various monitoring tools to track suspicious or anomalous activity across our networks, systems, and data, and we simulate cyber threats to proactively address vulnerabilities. Finally, we routinely train our employees on cybersecurity matters.


text: This program includes processes for triaging, assessing the severity of, escalating, containing, investigating and remediating information security events, as well as meeting legal obligations and minimizing customer impact and brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from a cybersecurity incident. Periodic tabletop exercises are conducted to test and reinforce our incident response controls, with incident severity and priority assessed on an ongoing basis.


text: We also conduct external and internal risk management audits to assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. We conduct periodic penetration testing to identify vulnerabilities in our products, services, and systems. We also undergo security-related industry certifications and attestations by external auditors, including System and Organization Controls (SOC) 1, SOC 2, International Organization for Standardization (ISO) 27001, 27017 and 27018, Cloud Security Alliance Security Trust Assurance and Risk (CSA STAR), Payment Card Industry Data Security Standard (PCI DSS) and other compliance frameworks. Additionally, our vendor risk management program identifies and mitigates risks associated with third-party service providers, including those within our supply chain and those with access to our customer or employee data or systems. We use the findings from these and other processes to review our information security practices, procedures and technologies.


text: Cybersecurity is an important area of focus for our Board of Directors. Our information security risk management program is designed to allow our Board of Directors to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board of Directors oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee (F&A Committee). As reflected in its charter, the F&A Committee assists the Board of Directors with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management, including Mr. Screven, our Executive Vice President and Chief Corporate Architect (Chief Corporate Architect). In turn, the F&A Committee reports to the full Board of Directors on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Corporate Architect, Chief Privacy Officer and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.


text: Index to Financial Statements Our Chief Corporate Architect is responsible for day-to-day identification, assessment and management of the information security risks we face. Our Chief Corporate Architect studied computer science at Carnegie Mellon University and has been with Oracle since 1986 in a number of positions. In his current role as Chief Corporate Architect, he drives technology and architecture decisions across all Oracle products and leads companywide strategic initiatives, including with respect to industry standards and security, to ensure that product development is consistent with Oracle's overall long-term strategy.


text: Our Chief Corporate Architect is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Chief Corporate Architect and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Chief Corporate Architect, who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board of Directors and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board of Directors and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.


text: We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program as well as cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo annual evaluations of our cybersecurity program, conducted by our cybersecurity external advisory firm.


text: Our cybersecurity program evaluation identified various risks and issues that we continue to mitigate to further improve our program. This includes: • Establishing a cybersecurity training program for users. • Implementing a third-party risk management program to support our existing Third-Party Risk Management Policy and process to assess the risks associated with our critical third-party vendor engagements. • Testing our Cybersecurity Incident Response Plan. • Establishing additional processes for identifying cybersecurity threats and vulnerabilities within the environment in which we operate. • Enhancing our technical security management safeguards and configurations.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We have a relationship with various law firms to assist with advisory on legal aspects of containing incidents and communicating accordingly.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") contractor. Our IT consultant leverages their over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents.


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives quarterly updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.


text: Cybersecurity Risks We maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, and quantify and evaluate their associated impacts and risk levels. A Cybersecurity Risk Register is also leveraged to track identified cybersecurity risks to date and update treatment of such risks accordingly.


text: For additional information, see "Item 1A—Risk Factors." In the last two reporting years, we did not experience any material cybersecurity incidents or threats.


text: Cybersecurity is a significant and integrated component of Central Plains Bancshares, Inc. risk management strategy. As a financial services corporation, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, The Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect The Company.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: To prepare and respond to incidents, the company has implemented a multi-layered cybersecurity strategy integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information and network security, data management, business continuity and disaster recovery, privacy, third-party risk management, and incident response. The company engages third-party consultants and independent auditors to, among other things, conduct penetration and vulnerability tests, monitor systems, perform cybersecurity risk assessments, and conduct audits.


text: The Information Technology Department is primarily responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the IT Manager who reports directly to the Executive Vice President/Chief Operations Officer (COO). The IT Manager has more than seven years of experience with the company and additional years of experience in the information technology ("IT") field. The IT Manager is assisted in overseeing Information Technology by an IT Managed Service Provider firm. The IT Manager and COO oversee the information security program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security & Network System Policy identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Commit and information from committee meetings and testing is reported to the Board.


text: The company has implemented an Incident Response Plan to provide a structured incident response process for information security incidents that affect any of the information technology systems, network, or data of the company. The Incident Response Plan is implemented and maintained by the COO.


text: On a periodic basis, but not less than annually, the COO, with the assistance of IT Department and Compliance/Risk Management staff, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessments, the company's processes and policies may be revised to protect against any anticipated threats or hazards to the security or integrity of such information.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested when possible. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the company.


text: Internal Controls, Audit, and Testing Regular internal monitoring is integral to the risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration and vulnerability testing to test the effectiveness of security controls and preparedness measures is conducted at least annually (generally quarterly for external testing and every 12 to 18 months for internal testing) or more often, if warranted by the risk assessment or other external factors. The COO and IT Manager determine the scope and objectives of the penetration and vulnerability analysis and audits.


text: Service Providers Like many companies, the company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the company maintains a Vendor Management Program, which is implemented through a Vendor Management Program Policy and includes an onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Program is audited as part of IT audits.


text: Employees and Training Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the company. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: At least annually, the Annual Electronic Data Processing Report & Risk Assessment is presented to the Board. The report provides an overview of IT operations, core providers, IT policies, audit and testing information, and IT strategic accomplishments and future planned IT initiatives. The report also includes an IT Risk Assessment and risk matrix. IT audit findings are included on the Master Exam/Audit Tracking Report of Action Items which is presented to the Board bi-monthly.


text: Program Adjustments The COO, with the assistance of the IT Manager, monitors, evaluates, and adjusts the Information Security & Network Systems Policy considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan To ensure that information security incidents can be recovered from quickly and with the least impact to the company and its customers, the company maintains an Incident Response Policy which is designed to work in conjunction with the Disaster Recover/Business Continuity Plan. The COO is responsible for implementing and maintaining the Incident Response Policy.


text: Risk management and Strategy We have processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties. We engage third-party consultants and legal advisors in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We have a Written Information Security Program ("WISP") to protect personal and proprietary information in compliance with applicable federal and state requirements. WISP is designed to: • Ensure the security and confidentiality of personal information; • Protect against any anticipated threats or hazards to the security or integrity of personal information; and • Protect against unauthorized access to or use of such personal information in a manner that creates a substantial risk of identity theft or fraud. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB incident response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The head of IT has served in various roles in information technology and information security for over 28 years, including serving in technical management and leadership positions in multiple verticals for 19 years. The head of IT holds undergraduate and graduate degrees in computer science and has attained the several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Risk management and strategy We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: We work with industry-leading third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, legal advisors, threat intelligence service providers, and penetration testing firms. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response plan, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us. To address this, our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a vendor and work with the vendor to address or mitigate those risks.


text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks, see Item 1A, "Risk Factors" in this Annual Report.


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Audit Committee of the Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. The Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer. In addition, on at least an annual basis, the full Board of Directors receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our CIO.


text: Our cybersecurity program and related initiatives are managed by the CIO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: Our CIO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters.


text: Our security operation center monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO and functional areas (e.g. legal) as appropriate. The CIO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: Risk Management and Strategy We are committed to protecting the confidentiality, integrity, and availability of our systems and information. Our security program is intended to assess, identify, and manage risks from cybersecurity threats, and is aligned with the National Institute of Standards and Technology Version 2.0 Cybersecurity Framework ("NIST CSF"). The NIST CSF provides a flexible model for identifying and managing cybersecurity risks. Our security infrastructure uses a layered controls approach, incorporating various capabilities guided by the NIST CSF and other industry standards and best practices. We routinely invest in our security processes and capabilities, including those related to our risk management and assessment programs, vulnerability and intrusion detection, incident response plans, and other advanced detection, prevention, and protection capabilities.

companyName: PAYCHEX INC

ticker: PAYX


text: We conduct regular assessments of cybersecurity risks to identify threats to us and potential vulnerabilities that could negatively affect our business operations if exploited. We track cybersecurity risks within our enterprise risk management system with cybersecurity threats considered to be among the top-priority risks to us. In addition, our Enterprise Security Organization (the "ESO") conducts technical risk assessments, and, in some instances, we engage with third-party experts to assist with or perform technical risk assessments. The results of these risk assessments are reported to management. Our processes require escalation of significant cybersecurity risks to management and Paychex's Audit Committee derived from the Board of Directors (the "Board").


text: The ESO is led by our Chief Information Security Officer ("CISO") and seeks to maintain a consistent, resilient, and secure infrastructure by partnering with resources across the Company. The ESO implements numerous cybersecurity processes and capabilities, which include but are not limited to: assessing risk associated with significant infrastructure or operational changes and the introduction of new technologies; administering our third-party service provider risk management program; managing secure software development and change management; managing access management and logical access controls, identifying security vulnerabilities through automated scanning technologies; performing penetration testing and due diligence assessments; and protecting the confidentiality, integrity, and availability of the Company's data in transit. The ESO includes the activities of the Paychex Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. We maintain incident response plans which outline the escalation, investigation, reporting, and overall response procedures depending on the type and severity of incidents.


text: As part of our security program, we require all employees to take information security awareness training upon hire and annually thereafter. We provide additional ongoing training to our employees about security best practices and awareness, including internal phishing simulations.


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing services to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.


text: As of May 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Cybersecurity risks are overseen by the Audit Committee of our Board. Annually, the Audit Committee reviews an assessment of our risk management processes with the Board. The Audit Committee is responsible for reviewing significant cybersecurity risk exposures and the steps management has taken to monitor, control, and report such exposures. The Audit Committee receives quarterly updates from our CISO regarding our cybersecurity risk management program. These updates include a status of current capabilities, ongoing initiatives, and the evolving cybersecurity threat landscape.


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our CEO and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.


text: Our CISO has over two decades of experience in various roles involving information security: developing and implementing cybersecurity programs to protect the confidentiality, integrity, and availability of information systems and data. Our CISO has earned relevant degrees and holds several information security certifications, including the Certified Chief Information Security Officer certification. Prior to joining Paychex in September 2019, he served as VP and CISO at a publicly traded company in the HCM industry. Before that, he held security leadership positions at several banks, insurance companies, and professional services firms.


text: Our CISO reports to our Senior Vice President of Information Technology and Product Development ("SVP of IT and PD"). Our SVP of IT and PD has over 45 years of experience in the field of information technology and has earned a relevant degree. Prior to joining Paychex in November 2008, he held senior leadership positions at several technology, financial services, and HCM companies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information with the aim to continually improve security to keep pace with the evolving cyber threat landscape.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our strategy toward managing cybersecurity risk in our business is informed by and aligned with the core principles and methods outlined within the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while including elements of the International Organization for Standardization's ISO/IEC 27001 publication and industry best practices. This does not mean that we seek to meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001, and other resources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Inclusive in these frameworks and our program are components for continuous improvement through feedback, self-review and external testing.


text: Our cybersecurity program leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including but not limited to firewalls, endpoint detection and response, anti-malware, immutable backups, multi-factor authentication schemes, data encryption, and security system information event monitoring to detect and respond quickly to any emergent threats. In addition, we periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability.


text: We also maintain a security awareness program with mandatory semi-annual training content and perform automated e-mail based phishing tests. Results of testing help to inform and provide continuous improvement of our security awareness training materials, approaches and strategies. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them, and the best use of our established communications channels.


text: We perform a formal cybersecurity risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to our operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program.


text: In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments designed to identify, assess, and manage cybersecurity risks, and to evaluate our overarching information security program and specific incident response procedures. We perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we continue to invest in this diligence regarding our critical vendors, our control over the security posture of our vendors is limited, and there can be no assurance that we can prevent or significantly mitigate the risk of any compromise or failure in the information assets owned or controlled by such vendors.


text: The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Director of IT reports to our VP of Finance, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our VP of Finance meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization.


text: The Director of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that may adversely affect our business, financial condition and results of operations. See Item 1A. Risk Factors, "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our cybersecurity" for further discussion.


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity and safeguarding our information systems and data assets. It is imperative that we maintain the trust and confidence of our customers, business partners and employees. Protecting our data and the data of our customers, business partners and employees is critical to maintaining that trust. As such, the Board is actively involved in overseeing our cybersecurity risk management program.

companyName: CULP INC

ticker: CULP


text: Risk Management and Strategy We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.


text: Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Third-Party Risk Management – regular evaluation and monitoring of our network of external partners, vendors, suppliers and service providers, which includes monitoring of third parties, securing vendor remote access, and implementation of protections against cyber threats that may arise through business-to-business system integrations; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity incident response plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Assessments – annual cybersecurity assessments, administered by a third-party specialist, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through monthly phishing simulation campaigns, "lunch and learns," and annual cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments - review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—Increasing dependence on information technology systems comes with specific risks, including cybersecurity breaches and data leaks, which could have an adverse effect on our business."


text: Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.


text: Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company's information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents. To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management.


text: Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.


text: We regularly assess our cybersecurity program's capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer ("CISO"), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.


text: Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.


text: We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.


text: We conduct table-top simulation exercises to regularly test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions. Additionally, we maintain cyber insurance designed to address certain aspects of cyber risks.


text: In the last three fiscal years to date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see Item 1A. "Risk Factors" of this Form 10-K. See "Item 1A. Risk Factors" of our Annual Report on Form 10-K for the year ended May 31, 2021, for information regarding the 2017 NotPetya cyberattack at TNT Express.


text: Cybersecurity Governance The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors ("CyTOC") responsibility for overseeing the company's cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company's cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company's business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.


text: The CyTOC receives regular updates from our CISO, Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, risks appropriate for Board-level awareness, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, while significant risks are reported on a quarterly basis.


text: Our CISO, who reports to the Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, leads our information security team and has responsibility for overseeing FedEx's cybersecurity program. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.


text: The FedEx Information Technology Risk Council ("ITRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The ITRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.