text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the SecOps Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Vice President of Information Technology (who has 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We and our third-party service providers have frequently been the target of cybersecurity threats and expect them to continue, and for an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: EXELIXIS, INC.

ticker: EXEL

secItem: Item 1C


text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the Security Ops Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Senior Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Senior Vice President of Information Technology (who has over 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Senior Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).


text: Risk Management and Strategy The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") - Global Business & Information Services, Vice President ("VP") Information Services, and Senior Director of Information Technology Operations and Governance. We take a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats; • network perimeter firewalls, including malware prevention; • e-mail scanning to prevent spam and phishing campaigns; • vulnerability scanning and remediation of vulnerabilities based on priority; • logical access controls, including multi-factor authentication; • incident response procedures; and • disaster recovery protocols.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The Company educates its workforce as part of our security awareness program to understand the risks and potential impacts cybersecurity threats pose to our business, and ways employees can remain vigilant to prevent cybersecurity incidents from occurring. The program includes annual employee acknowledgement of security related policies, ongoing communication about prevalent vulnerabilities, security awareness training, and simulated phishing campaigns.


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our information systems environment, identify suspicious activity, and perform actions to prevent or stop attacks.


text: The Company maintains a cybersecurity insurance policy that provides coverage for potential losses arising from a cybersecurity incident. Although we maintain cybersecurity insurance, there can be no guarantee that our policy will cover all losses or all types of claims that may arise from such incidents.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Company's Board of Directors receive updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 35 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, the internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks are discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") – Global Business & Information Services, Vice President ("VP") – Global Business Systems, VP – Global Information Technology Operations and Governance, and Senior Director – Data Insights and Innovation. We utilize a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats, • network perimeter firewalls, including malware prevention, • e-mail scanning to prevent spam and phishing campaigns, • vulnerability scanning and remediation of vulnerabilities based on priority, • logical access controls, including multi-factor authentication, • incident response procedures, and • disaster recovery protocols.


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our end points, identify suspicious activity, and perform actions to prevent or stop attacks.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Board of Directors receives updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 36 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, an internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks is discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy We have implemented policies and procedures intended to manage and reduce cybersecurity risk that are integrated with the Enterprise Risk Management ("ERM") framework utilized by management and the Audit Committee to oversee our various top enterprise risks. We maintain an incident response plan that is designed to protect against, identify, evaluate, respond to and recover from a cybersecurity related incident. The plan provides for the creation of an incident response team in the event of an incident and it is designed to be flexible enough to accommodate a broad array of potential scenarios. The incident response team is a cross-functional group that may be composed of both Company personnel and external service providers, and that is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We conduct regular exercises to help ensure the plan's effectiveness and our overall response preparedness.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We periodically engage third parties to perform cybersecurity audits to measure the maturity of our cybersecurity program against the National Institute of Standards and Technology (NIST) Framework. We also engage third parties to conduct security reviews of our network, processes and systems on a regular basis to identify opportunities and enhancements to strengthen our policies and practices.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding and we continue to reassess vendors using a risk-based approach. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of information security incidents occurring on their systems that may affect our systems or data, including personal information.


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Information Technology and Cybersecurity" in our Risk Factors in Item 1A of this Form 10-K.


text: Our Board of Directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the Board of Directors on its specific risk oversight activities. The Audit Committee, comprised solely of independent directors, oversees our overall ERM program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), all of which are fully integrated into our ERM program. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports out to the full Board of Directors on our relevant strengths and opportunities.


text: Our cybersecurity program is led by our Chief Information Officer (CIO), who is responsible for identifying, assessing and managing our collective information security and technology risks. Our current CIO has served in that role since 2016 and has more than 20 years of experience in the information security and technology fields. Our CIO holds both bachelor's and master's degrees in Electrical Engineering from the Massachusetts Institute of Technology.


text: The CIO meets regularly with leaders of our various information technology management teams to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit Committee receives periodic updates from the CIO, the director of our cybersecurity team and a senior attorney, the three most senior leaders with responsibility for oversight of our key cybersecurity program components. These updates include matters such as ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness. Our CIO also provides updates to the full Board of Directors on such topics at least annually.


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks, including maintaining insurance coverage to mitigate the potential financial consequences of cybersecurity incidents, and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Relating to Information Technology, Cybersecurity and Privacy" in our Risk Factors in Item 1A of this Form 10-K.


text: Risk Management and Strategy We seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Our management team has adopted policies, standards, processes, and practices and implemented controls and procedures that allow us to assess, identify and manage material risks from cybersecurity threats enabling our board of directors to actively oversee the strategic direction, objectives, and effectiveness of our cybersecurity risk management framework. Our processes are integrated into our overall enterprise risk management program, as implemented by management and as overseen by our board of directors. Our board of directors has an important role in risk oversight.

companyName: RESMED INC

ticker: RMD


text: To identify and assess material risks from cybersecurity threats, we use a risk assessment process aligned with standard industry frameworks such as the National Institute of Standards and Technology, or NIST, International Organization for Standardization, or ISO, 27001 and other industry standards. We engage in regular network and endpoint monitoring, vulnerability assessments, and penetration testing, among other exercises. We continuously monitor threats and unauthorized access to our network through both internal and external third-party resources. We have developed incident response plans which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We provide annual privacy and security training for all employees which incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We have also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of critical third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. Additionally, we require those third parties that could introduce significant cybersecurity risk to us to provide ISO certifications or Service Organization Controls, or SOC, 2 reports as evidence of a cybersecurity audit and these reports are reviewed and assessed for risk.


text: We review our cybersecurity risk framework and related policies both internally and externally by third parties at least annually. Our risk management program is also reviewed annually as part of SOC 2 and Health Information Trust Alliance, or HITRUST, Common Security Framework audits.


text: recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: cybersecurity program is led by our Chief Technology Officer ("CTO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CTO has extensive information technology and program management experience and many years of experience with our organization. Our CTO reports to our president and CEO.


text: the complexity and evolving nature of cybersecurity threats, we engage with external experts in evaluating and testing our risk management systems. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with the third-party includes threat assessments and consultation on security enhancements. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates.


text: board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.


text: acknowledging the existence of various cybersecurity risks, to date, they have not materially affected our business strategy, results of operations or financial condition. Although we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.


text: Our cybersecurity program is led by our Chief Information Officer ("CIO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology and program management experience and many years of experience with our organization. Our CIO reports to our president and CEO.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts in evaluating and testing our risk management systems. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with the third-party includes threat assessments and consultation on security enhancements. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.


text: Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.


text: While acknowledging the existence of various cybersecurity risks, to date, they have not materially affected our business strategy, results of operations or financial condition. Although we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor.


text: We maintain a comprehensive cybersecurity program designed to protect both customer data and our proprietary information. Our cybersecurity framework is governed by our Board of Managers and driven by a dedicated Information Security Officer, ensuring that all processes comply with regulatory requirements and industry best practices. This framework is documented in our Cybersecurity Policy and Information Security Program Policy, which outlines the risk management, preventive, detective, and corrective controls we have implemented across the organization.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: Our approach begins with regular, in-depth risk assessments that identify both inherent and residual cybersecurity risks. Utilizing standards such as the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institutions Examinations Council guidance, and the foundational safeguards outlined in CIS Controls v8, we continuously monitor, evaluate, and update our security controls. These assessments allow us to effectively manage vulnerabilities across our Company assets and software, ensuring that only authorized and securely configured systems are connected to our network. In addition to proactive risk identification, our cybersecurity process includes a robust incident response capability. We maintain detailed procedures for detecting, containing, and remediating cyber threats, which are regularly tested through internal audits and third-party assessments. This ensures that should an incident occur; our team can swiftly activate the Incident Response Plan to minimize potential impacts and restore secure operations.


text: We extend our cybersecurity diligence to third-party service providers and require periodic employee training. All external partners are required to adhere to our cybersecurity standards, and our employees receive ongoing training to stay current with emerging threats and best practices. This comprehensive, layered approach not only safeguards critical data but also reinforces our commitment to continuous improvement and compliance with statutory and regulatory requirements.


text: Our Board of Managers retains supervisory oversight responsibility for enterprise risk management and cybersecurity risks. The primary responsibility for maintaining an information security has been assigned to an Information Security Officer (" ISO "). The ISO works with the Audit Committee to address information security risks found by each business segment. Our ISO conducts an annual risk assessment report and submits the report to the Audit Committee for its review. The Audit Committee meets with Company management, the ISO and external auditors to review the Company's risk management processes and enterprise-wide risks found by the Company. The scope of this review is intended to address cybersecurity governance risks and related controls and identify any deficiencies that could adversely affect the Company's ability to record, process and report financial data. As of the date of this Report on Form 10-K, there have been no cybersecurity incidents we believe have had a material effect on our operations, business, results of operations or financial condition.


text: Risk Management and Strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the standardized framework established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. The NIST Cybersecurity Framework ("NIST CSF") helps the Company prioritize its cybersecurity activities and take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. We rely on a cybersecurity team that works to identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents through risk management and strategy. Our cybersecurity team has adopted procedures to promptly address material risks to the Company's cybersecurity environment, with a triage and remediation protocol in place. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: As part of our cybersecurity defense structure, our internal cybersecurity team performs the following actions, without exclusion: (i) tracking cybersecurity risks, threats and incidents to help identify and analyze them; (ii) promptly reporting significant cybersecurity risks, threats and incidents to our CIO; and (iii) utilizing third-party vendors and software for review, testing, preemption and monitoring of cybersecurity risks, threats and incidents.


text: In addition, our CIO closely monitors the cybersecurity team's approach with regular reviews of security risks and vulnerabilities, security strategy and the implementation of mitigation plans and technology, and reports quarterly to our Audit Committee and Board of Directors on, among other things, threats, mitigation measures, and preventative procedures and software.


text: We have a robust cybersecurity training and awareness program that requires all employees to complete mandatory cybersecurity awareness, information handling, and privacy training at the time of onboarding and on an annual basis thereafter. In addition, we regularly test our employees compliance with best practices using various techniques, such as simulated phishing campaigns, to validate the efficacy of our cybersecurity training.


text: We have implemented solutions, processes, and procedures to help mitigate the risk of cyberattacks, such as conducting annual vulnerability testing, and periodically engaging third-party experts to assist us with tasks such as implementing our incident response plan and conducting tabletop exercises.


text: The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Furthermore, the Company's cybersecurity program is periodically reviewed and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: As are other businesses, from time to time, we have experienced efforts by unknown persons, including "bots", to access or breach our information systems, which have been prevented based on measures put in place by the Company. However, there can be no assurance we will be able to protect sensitive data and/or the integrity of the Company's information systems and to defend against such efforts in the future. See Item 1A. "Risk Factors" of this Form 10-K.


text: As the head of our cybersecurity team, our CIO reports quarterly on cybersecurity to our Audit Committee, which has primary responsibility for cybersecurity oversight, and also to our full Board and regularly reports to the Chief Executive Officer on such cybersecurity matters. Cybersecurity risk is assessed and tracked as a significant risk faced by the Company and is closely managed along key risk indicators covering security maturity, risk exposure, and security operations. Performance against these indicators is regularly measured and discussed, among other things, in our Board reporting.


text: The members of our cybersecurity team have risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team maintains expertise on cyber risk management through certified security professionals on staff, external training and affiliations with relevant organizations. Additionally, we regularly engage with third party assessors, consultants, and advisors as needed for reviews and testing of our cybersecurity risk management systems.


text: We have established a comprehensive incident response and recovery plan to identify, protect, respond to and recover from cybersecurity threats and incidents. The plan includes processes for the activation of the crisis management team (comprised of the Company's Chief Executive Officer, Chief Financial Officer and General Counsel), incident handling, and prompt and fulsome reporting to the Board upon discovery of a breach that could reasonably be material upon further investigation. Our procedures require reporting up the chain of command, even while materiality assessments are still being determined. In addition, we have pre-negotiated contracts with external third-party incident response providers to guide and assist the internal crisis management team as needed.


text: We rely on the information technology and systems maintained by our managers, including RMR, and rely on our managers to identify and manage material risks from cybersecurity threats. RMR and our hotel managers take various actions and incur significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Service Properties Trust

ticker: SVC


text: Risk Management and Strategy Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.

companyName: POOL CORP

ticker: POOL


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and quarterly cybersecurity training of our employees. In an effort to mitigate cyber risks for customer-facing software, we incorporate the protocols described above along with software specific programs such as a bug bounty system and partnerships with external experts.


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We incorporate the lessons learned from these engagements into our cybersecurity program. Our cybersecurity program also includes controls to manage risks associated with our use of third-party service providers; however, we cannot ensure in all circumstances that their defensive efforts will be successful.


text: Like most large organizations, we face constant and dynamic risks related to cybersecurity. In recent years we have faced, and expect to continue to face, various attempted cyber-attacks of increasing sophistication. To date, we are not aware of any cybersecurity incident or threat that materially impacted or could reasonably be anticipated to materially affect our business, results of operations or financial condition. However, we cannot guarantee that we will not experience such an incident in the future. For a further description of these risks, see "Risk Factors – Risks Relating to Technology, Cybersecurity and Data Privacy," included in Item 1A of this Form 10-K, which should be read in conjunction with this Item 1C.


text: Our Board of Directors (Board) is responsible for oversight of our risk management programs and assisting management in addressing specific risks, including cybersecurity risks. The Audit Committee assists our Board in reviewing cybersecurity and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee also helps in reviewing with management any specific cybersecurity issues that could have a material impact on us. Our Chief Information Officer (CIO) provides the Board with updates on cybersecurity risks at regularly scheduled board meetings at least twice a year. These updates include the results of any third-party reviews and related remediation items.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: At the day-to-day operational level, our CIO manages an information security team tasked with executing our cybersecurity program. This team includes a director of network security, technical director of enterprise architecture, system architects and network security staff. Members of our information technology (IT) management group, led by our CIO, have extensive years of combined experience in defending large, complex corporate environments. Our CIO, IT management group, architects and network security team members receive briefings and annual training on cybersecurity threats and response methods that provide real world threat scenarios to measure the effectiveness of our programs and technologies in protecting our systems. Our team of professionals also monitors our compliance with laws governing privacy rights, data protection and cybersecurity.


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, includes activating response plans from third-party partners, escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Risk Management and Strategy Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats. Our program leverages components from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which we use to help us identify, assess and manage cybersecurity risks relevant to our business. O ur cybersecurity program is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and emphasize the importance of cybersecurity across our organization through quarterly trainings, which include best practices and participation in simulated phishing exercises to strengthen employee vigilance.


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We also regularly test our environment as part of our focus on identifying and eliminating vulnerabilities. We incorporate the lessons learned from these engagements into our cybersecurity program. Recognizing the risks posed by external partners, we have implemented a third-party risk management program, which includes due diligence assessments, contractual safeguards, and regular monitoring of vendors and partners with access to our systems or data; however, we cannot ensure in all circumstances that their defensive efforts will be successful.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO, who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, may include escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Risk Management and Strategy Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is identified as a key risk area for the Company, and Management measures inherent risk, mitigating controls, and residual risk on a quarterly basis.

companyName: BANNER CORP

ticker: BANR


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Providing input for internal and external auditors and independent third-party engagements, including in relation to internal and external (i.e., third-party operated) penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). The ISO/IEC 27001 requirements provide a systematic and risk-based approach to managing sensitive information, ensuring its confidentiality, integrity, and availability. The requirements reflect best practices that organizations can use to guide an information security program. The Company considers these frameworks to be aspirational benchmarks to help inform the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents, and we have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident.


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes a risk appetite for each, as well as specific associated risk metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and also identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system and domain name security. It is tailored to align with the Company's size and complexity and the nature and scope of our activities.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 25 years of information technology experience. In addition, the Bank's Chief Information Security Officer (CISO) has been with the Company for more than 12 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing. The CIO and the CISO are supported by a team of information technology and information security specialists.


text: Our Information Technology (IT) Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee regarding the overall status of the Information Security Program. This reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.


text: We maintain a Cybersecurity Incident Response Team (CIRT), which is responsible for addressing the technical aspects of the Company's response to cybersecurity events. Additionally, our cross-functional Executive Cybersecurity Event Evaluation Team (ECEET) is responsible for assessing the potential business impacts and disclosure requirements related to cybersecurity events. Both the CIRT and the ECEET may consult cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other governance groups, which may include the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receive a quarterly report from the chair of the ECEET.


text: Risk Management and Strategy Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, leveraging a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is considered to be a key risk area for the Company, with Management measuring inherent risk, mitigating controls, and residual risk on a quarterly basis.


text: The ability to mitigate cybersecurity risks depends on an effective risk assessment process that identifies, measures, controls, and monitors material risks from cybersecurity threats. These threats include any potential unauthorized activities that could compromise the confidentiality, integrity, or availability of the Company's information systems and data. Our Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Conducting internal and third-party security assessments, including penetration testing. • Overseeing third-party vendor risk through due diligence and monitoring.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). These frameworks provide best practices for managing cybersecurity risks and ensuring information security, and we consider them to be aspirational benchmarks to help inform the design of our Information Security Program. While our program is designed to be robust, the sophistication and evolving nature of cyber threats mean no system can fully eliminate risk. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established procedures for the timely escalation and, when required, disclosure of cybersecurity incidents, supported by a formal incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident. While cybersecurity risks could materially affect the Company, past incidents have not materially affected our business strategy, results of operations or financial condition. For further details on potential cybersecurity risks, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors annually reviews and approves the Company's Risk Appetite Statement, which defines key risk categories and associated metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect sensitive information in accordance with FDIC and FFIEC regulations. The program is tailored to align with the Company's size, complexity and operational scope.


text: Cybersecurity risk management is led by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), supported by our information technology and information security teams. The Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 26 years of information technology experience. The Bank's Chief Information Security Officer (CISO) has been with the Company for more than 13 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing.


text: Our Information Technology (IT) Management team is responsible for conducting risk assessments, designing the Information Security Program, overseeing service provider arrangements, establishing risk-based response programs for incidents involving unauthorized data access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program to reflect changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee on the status of the Information Security Program, including risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents and recommendations for improvements. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. The Board of Directors' Corporate Governance/Nominating Committee considers IT and cybersecurity expertise when assessing potential director candidates to help ensure effective oversight by the Board of Directors.


text: We maintain a Cybersecurity Incident Response Team (CIRT) to handle technical aspects of the Company's response to cybersecurity events and an Executive Cybersecurity Event Evaluation Team (ECEET) to assess potential business impacts and disclosure requirements related to cybersecurity events. Both teams may engage cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process facilitates updates to internal governance groups, including the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receives a quarterly report from the ECEET chair.


text: Risk management and strategy We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. For example, to identify and assess risks from cybersecurity threats, our enterprise risk management program considers cybersecurity as part of the Company's risk assessment process, and our risk management framework requires risk owners to monitor key risks such as cybersecurity on a continuous basis. See Item 1, " Business—Enterprise Risk Management " for additional information.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks. Our privacy and information security policies and standards govern our business lines and subsidiaries and encompass incident response, access control, and vendor management, among others. In order to develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.


text: We annually undergo an external evaluation by a third party cybersecurity firm with a specialty in penetration testing. Our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third party service providers. In addition, the Company negotiates appropriately protective terms in its legal agreements with these providers.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions that we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents. See Item 1A, " Risk Factors—Risk Relating to Our Industry, Business & Operations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation."


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").


text: Our cybersecurity and IT executives include our CIO, who has 33 years of experience in Information Technology, including 20 years in the financial services space. His responsibilities as the CIO include information security oversight, and board reporting. Our CISO, has 18 years of experience in Information Security. The CISO holds certifications from leading security associations. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.


text: • The Privacy and Security Committee ("P&S Committee"), co-chaired by the CISO and our Deputy General Counsel, brings together Information Security, legal, compliance, human resources and other function leads. The P&S Committee provides a forum for these cross-functional members of management to: consider new laws and regulations relating to privacy and security; consider emerging risks relating to cybersecurity and data protection; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Operational Risk Committee ("ORC"), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company's programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO's quarterly report to the Audit Committee. • The Crisis Incident Management Team ("CIMT"), which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Each quarter, the CIMT exercises its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. • The IT Steering Committee ("IT Committee", which includes our CIO, CISO, COO and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives.


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.


text: At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions. We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents. Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology ("IT") processes encompassing incident response, access control, disaster recovery and testing, among other areas. These policies and standards are regularly reviewed and updated at least annually based on the risk and regulatory environment in which we operate. We monitor closely privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.


text: We use many third parties for IT functions and our vendor management group performs information security risk assessments on our third-party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third-party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third-party service providers.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. We annually undergo an external penetration testing by a third-party cybersecurity firm. These tests and our tabletop exercises enable us to incorporate recommendations and learnings in our program. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including IT risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").


text: Our cybersecurity and IT executives include our CIO, who has 34 years of experience in Information Technology, including 21 years in the financial services space. His responsibilities as the CIO include all areas of Information Technology and information security oversight. Our CISO, has 19 years of experience in information security. The CISO holds certifications from leading security associations. The information security personnel reporting to the CISO hold various leading security certifications. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO. We also have an enterprise Artificial Intelligence Governance and Oversight Committee focusing on the use and management of AI in our operations.


text: The Company's information security program is designed to protect the security of our computer systems, networks, software and information assets, including customer information. The program is comprised of technical controls, policies, guidelines, and procedures. These technical controls, policies, guidelines, and procedures are intended to align with regulatory guidance, and common industry standard security practices.

companyName: FIRST BANCSHARES INC /MS/


text: The board of directors and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.


text: Commitment to Security and Confidentiality At the Company, we expect each associate to be responsible for the security and confidentiality of customer information. We communicate this responsibility to associates during on-boarding and throughout their employment. Annually, training courses are assigned to each associate to complete on how to protect the confidentiality of customer information at the time of hire and during each year of employment.


text: We regularly provide associates with information security awareness training, including the recognition and appropriate handling of potential phishing emails, which can introduce malware to a bank's network, result in the theft of user credentials and, ultimately, place customer information at risk. We regularly use phishing campaigns to train associates to determine their ability to recognize phishing emails. For associates who fail a phishing campaign, the associates are assigned additional training courses.


text: Associates must also follow established procedures for the safe storage and handling and secure disposal of customer information. Old or obsolete computer assets are subject to defined procedures and processes to ensure safe destruction of information contained on those devices. For paper-based information or documents, we dispose of paper using shred bins for destruction.


text: Cybersecurity Incident Response Plan As part of our information security program, we have adopted an Information Security Incident Response Plan (Incident Response Plan), which is administered by the Company's Chief Information Security Officer (CISO). The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to incidents including security and cybersecurity. The Incident Response Plan is intended to be followed in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business units, communications, legal, and risk personnel. The Incident Response Plan includes an annual tabletop exercise to simulate responses to cybersecurity events. If applicable, each exercise may result in postmortem and discuss lessons learned to evaluate any improvements to the Incident Response Plan. The Incident Response Plan includes processes for escalation and reporting of cybersecurity incidents to the Incident Response Team.


text: Network and Device Security The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure VPN and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.


text: Cybersecurity training is provided to all employees as part of the overall cybersecurity program. The Company contracts with third party vendors to conduct internal and external penetration tests against the Company's networks and IT assets to ensure controls are operating in an appropriate manner.


text: Impacts of Cybersecurity Incidents To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Addressing cybersecurity risks is a priority for the Company, and the Company is committed to enhancing its systems of internal controls and business continuity and disaster recovery plans.


text: Third-Party Vendor Controls Before engaging third-party service providers, the Company carries out a due diligence process. This process is led by the Enterprise Risk Management team and Information Security performs due diligence through the process. Risk assessments are reviewed using Service Organization Controls (SOC) reports, self- attestation questionnaires, and other tools.


text: Any third-party service provider or vendor utilized as part of the Company's cybersecurity framework is required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing sensitive customer data are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract executions, vendors undergo ongoing monitoring to ensure they continue to meet their security obligations.


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.


text: The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: Our Management's Role in Assessing and Managing Cybersecurity Matters The Company's CISO directs the Company's information security program and our information technology risk management. The CISO and Cybersecurity Manager along with a team of dedicated security personnel examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides immediate responses to threats.


text: Role of the Chief Information Security Officer and Cybersecurity Manager Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program.


text: The CISO has experience with FDIC regulated financial institutions and holds the certification as a Certified Banking Chief Information Security Officer (CBISO) and participates in various Information Security peer groups and serves on the Mississippi Bankers Associations - Information Security Committee. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.


text: Our Cybersecurity Manager has experience spanning multiple OCC and FDIC regulated financial institutions across the nation. He holds various cybersecurity related certifications and is currently registered with the International Information Systems Security Certification Consortium as a Certified Information Systems Security Professional (CISSP) member in good standing.


text: Role of the Enterprise Risk Manager Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.


text: Role of the IT Risk Governance Subcommittee Governance of the information security program begins with the IT Risk Governance Subcommittee, a management level subcommittee, whose objective is to protect the integrity, security, safety and resiliency of corporate information systems and assets. Together, our CISO leads the Company's IT Risk Governance Committee. The IT Risk Governance Committee meets regularly to review the development of the program and develop recommendations and provides regular reports to management, and, ultimately, the Board Risk Committee through the CISO.


text: Role of Enterprise Risk Management Enterprise Risk Management (ERM) is a holistic process to identify, assess/measure, mitigate/control, and aggregate/escalate/report organizational risks, both internal and external, in order to make decisions aimed at maximizing shareholder value and achieving strategic goals. The overarching ERM program shapes information security strategy and development. ERM works with information security management to facilitate performance of Risk Assessments, the results of which are used to identify opportunities to strengthen the program.


text: The Board and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.


text: Network and Device Security The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure virtual private network (VPN) and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board of Directors oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.


text: The Board of Directors' Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.


text: The Board 's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board of Directors, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: Role of the Chief Information Security Officer and Cybersecurity Manager Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board of Directors and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.


text: Role of the Enterprise Risk Manager Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high-level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.


text: Risk Management and Strategy In our business, we recognize the risk that cybersecurity threats pose to our operations, and as such, cybersecurity is an important component of our overall risk management strategy. We have adopted and implemented an approach to identify and mitigate cybersecurity risks utilizing the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guideline to help management identify, assess, reassess, and manage cybersecurity risks. We have developed and implemented cybersecurity programs and processes, including risk management and assessment programs, network segmentation, deployment of detection tools across our network, systems and databases, security and event monitoring capabilities, a detailed incident response plan and an incident response team. Our incident response team is led by our Chief Information Officer, who has over 22 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies, and also includes our General Counsel and our Chief Financial Officer.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: We conduct an initial assessment on the cybersecurity profile of our third party vendors as they are onboarded and evaluate their cyber security programs and safeguards before utilizing them in our environments. We utilize cyber intelligence to provide continuous monitoring and scanning of systems to provide awareness if any of our vendors have security incidents. Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services to maintain certain security protections including compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including storage, transmission, and access.


text: We have implemented advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate threats. We provide at least quarterly company-wide cybersecurity information training and routinely communicate with employees about the potential for cybersecurity threats. We additionally deploy technical safeguards that are designed to protect our information systems from cybersecurity threats including firewalls, intrusion penetration and detection systems, anti-malware functionality and access controls, vulnerability assessments and cybersecurity threat intelligence. We continuously monitor and assess our information technology and data assets to detect anomalies and to respond quickly to threats that may arise. In certain instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments, information security program assessments and external threat environment reviews.


text: We perform periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these evaluations.


text: Our incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, assessing materiality and communication or notification requirements, and reducing the likelihood of future incidents. In the event of a real or perceived cybersecurity incident the information technology team would, as soon as practicable, inform the incident response team, the members of which would then collaborate to assess a strategy and manage the risks.