text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity, and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations, and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.

companyName: AMEDISYS INC

secItem: Item 1C


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments and penetration testing, to inform our leadership team of cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to test our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes in order to comply. • Conducting annual cybersecurity management and incident training for all employees of the organization. • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care. • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Additionally, Amedisys performs periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually during our penetration testing.


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.


text: We face a number of cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. On an annual basis, management provides the Audit Committee with an overview of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.


text: The members of management who are responsible for assessing and managing cyber risk are the Chief Information Security Officer and the Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the cyber incident response and reporting processes.


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined by the SEC in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity related processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments and penetration testing, to mitigate our cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to evaluate our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes to maintain compliance; • Conducting annual cybersecurity management and incident training for all employees of the organization; • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care; • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident, although our insurance coverage may be insufficient to cover all losses from a cybersecurity incident or our insurer may deny coverage for a claim.


text: Additionally, Amedisys performs periodic internal and third-party assessments to evaluate our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain and investigate and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually for effectiveness during our penetration testing.


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or that have facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.


text: We face cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks, and future such events or circumstances could have a material adverse effect on our business and consolidated financial condition, results of operations or cash flows.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Audit Committee receives updates from management on a regular basis of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.


text: The members of management who are responsible for assessing and managing cyber risk are the Acting Chief Information Security Officer and the Acting Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. Our Acting Chief Information Security Officer is responsible for our cybersecurity risk management program and reports directly to the Acting Chief Information Officer. The Acting Chief Information Officer is a member of the ERMC and accountable for informing and updating the ERMC on cybersecurity risk management. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the Company's cyber incident response and reporting processes.


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and, to some extent, data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.


text: As part of our cybersecurity risk management program, our incident response team tracks and logs cybersecurity and data privacy incidents across the Company to identify, assess, mitigate, remediate, and resolve any such incidents. Prior to forming a contractual relationship with a material vendor or third-party service provider that will have access to our information systems or data, we perform due diligence on their cybersecurity and data privacy posture. We conduct annual reviews and tests of our information security program and we periodically review and update our cybersecurity policies. We also periodically utilize qualified third parties to evaluate and assess our cybersecurity risk management program, including through conducting cybersecurity maturity assessments. We utilize cybersecurity user awareness trainings with our employees, cybersecurity insurance, business continuity mechanisms, tabletop exercises, penetration testing, and vulnerability scanning to evaluate the effectiveness of our information security program and improve our security measures and planning. The material results of these assessments are reported to our executive leadership team and the Governance, Risk and Nominating Committee of the Company's Board of Directors (the "Board").


text: We have adopted a cybersecurity and data privacy incident response plan that provides a framework for identifying, classifying, documenting, and responding to cybersecurity and data privacy incidents and determining whether reporting of an incident is appropriate or required under regulatory standards. The plan also includes a materiality assessment framework to assist us in determining whether a security incident is "material" under the federal securities laws. A cross-functional working group reviews significant cybersecurity incidents under this framework to assess the incident and, among other things, determine whether further assessment and escalation of the incident within USANA is appropriate. Any incident assessed as being or potentially becoming material is immediately escalated to designated members of our executive leadership team. We consult with outside cybersecurity and data privacy consultants and legal counsel as appropriate, including on cyber incident significance and/or materiality analysis and disclosure matters, and designated members of our management team make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Governance Risk and Nominating Committee and, where necessary, our independent registered public accounting firm, of cybersecurity matters and relevant developments, as appropriate. Governance.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Governance, Risk and Nominating Committee the ultimate oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity and data privacy professionals regularly discuss cyber risks and trends and, should they arise, any material incidents with management and the Governance, Risk and Nominating Committee. Material Risks from Cybersecurity Threats.


text: As a global company with operations and customers in 25 markets, we encounter a variety of cybersecurity threats. However, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. Nevertheless, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors." of this Annual Report on Form 10-K.


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Executive Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Executive Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.


text: Increased global cybersecurity threats and sophisticated, targeted computer crime could pose a risk to our operations. Aptar has strategically integrated cybersecurity risk management into a broader enterprise-wide risk management framework, and consists of administrative, operational, organizational, physical, and technical processes that we believe are appropriate to the scope and nature of our business. We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our risk management team works closely with our Information Security Department to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.

companyName: APTARGROUP, INC.

ticker: ATR


text: Our cybersecurity strategy focuses on continued strengthening of our security posture, improvement of security operational efficiencies, and preparedness for evolving business and technology needs including the detection, analysis, and response to known, anticipated or unexpected cybersecurity threats, management of material risks related to cybersecurity threats and resilience against cybersecurity incidents. We regularly assess potential threats and make investments seeking to reduce the risk of these threats against our critical information and assets by implementing a broad set of security measures, including comprehensive monitoring of our networks and systems, rapid detection and response, and threat management capabilities. For example, we scan our systems for vulnerabilities and annually engage external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity systems. The results of such assessments and reviews are reported to our Information Security Department and Audit Committee of the Board of Directors (the "Audit Committee"), and then we consider adjustments to our cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, which is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Management briefs the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Our Information Security Department, reports to our Vice President and Chief Information Officer and is headed by our Director of Information Security. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Vice President and Chief Information Officer is an experienced information technology professional with 34 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. The Information Security Department ultimately reports to, and regularly informs, our Chief Information Officer and Chief Financial Officer with regard to cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Director of Information Security. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.


text: The Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of independent directors with diverse experiences, including relating to risk management, technology, and finance. Management briefs the Audit Committee on a quarterly basis, and on an as needed basis, regarding our information security program and related risks to Aptar. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's risk management system, including cybersecurity programs. The Audit Committee receives regular updates on any significant developments relating to cybersecurity. Furthermore, significant cybersecurity matters and related strategic risk management decisions are escalated to the Board of Directors.


text: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "Increased global cybersecurity threats and more sophisticated, targeted computer crime could pose a risk to our operations" in Part I, Item 1A of this report.


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Management reports to the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Our Information Security Department, reports to our Chief Information Security Officer who reports to the Chief Information Officer. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Chief Information Officer is an experienced information technology professional with 35 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. Our Chief Information Security Officer regularly informs our Chief Information Officer and Chief Financial Officer of any cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Chief Information Security Officer. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.


text: RISK MANAGEMENT AND STRATEGY We host, collect, process, use, and retain large amounts of sensitive and personal data across an array of our own and third-party information systems. To help protect these systems and data, we have implemented a robust information security program that includes numerous administrative, technical, and physical safeguards. We strive to evolve our cyber defenses to help minimize impacts from cyber threats. In general, we seek to address cybersecurity risks through a cross-functional approach. This approach focuses on protecting business operations and preserving the confidentiality, integrity, and availability of systems and data by preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur.

companyName: INTUIT INC.

ticker: INTU


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and has previously served as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 490 professionals as of July 31, 2024. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skillsets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context;


text: Tables of Contents • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.


text: Additionally, we maintain cybersecurity insurance which may cover some or all of the potential losses from a cybersecurity incident. During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected Intuit, including its business strategy, results of operations, or financial condition. However, we continue to face ongoing and increasing cybersecurity risks which may materially affect us in the future. Additional information on the cybersecurity risks is discussed in "Risk Factors" in Item 1A of Part I of this Annual Report, including without limitation the risk that "Security incidents, improper access to or disclosure of our data or customers' data, or other cyberattacks on our systems could harm our reputation, business, and financial condition."


text: Management is responsible for the day-to-day administration of the Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.


text: As part of management oversight, our CEO receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated to the Audit and Risk Committee to provide the primary oversight of cybersecurity risks. On a quarterly basis, the CISO and CyberCRAFT specialists present the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and also serves as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 500 professionals as of July 31, 2025. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skill sets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context; • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.


text: Management is responsible for the day-to-day administration of Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.


text: As part of management oversight, our Chief Executive Officer (CEO) receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated primary oversight of cybersecurity risks to the Audit and Risk Committee. On a quarterly basis, the CISO and CyberCRAFT specialists provide the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.


text: Risk Management and Strategy Our cybersecurity program framework is based on the Center for Internet Security's ("CIS") Critical Security Controls. We have policies and procedures in place based on best practices and guidelines from the National Institute of Standards and Technology ("NIST"), an agency of the United States Department of Commerce, and the Cybersecurity & Infrastructure Security Agency, an agency of the United States Department of Homeland Security. Our Information Technology ("IT") team works to protect not only our information, but also the information of third parties we may hold or control, including by implementing physical, electronic, and procedural safeguards to protect the confidentiality, integrity, and availability of Company computer systems. We also limit physical access to server, storage, and network equipment to necessary staff.

companyName: ALAMO GROUP INC

ticker: ALG


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of regulations. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.


text: Our process of assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management system. Our process of managing risks from cybersecurity threats includes monitoring information channels from trusted security information sources. We review third-party service providers that manage sensitive Company information prior to engaging any such provider. Our reviews align with relevant government compliance requirements and review of System and Organization Controls reports. We establish governance, processes, and tools for managing various third-party related risks, including information security. As a condition of working with the Company, third-party service providers who access sensitive business or customer information are expected to meet certain information security requirements. Our processes for assessing, classifying, and managing cybersecurity risks were created in collaboration with consultants and auditors. We maintain consulting relationships that provide guidance for responding to evolving cybersecurity risks. We require employees to undertake data protection, cybersecurity training, and compliance programs annually. Internal and external auditors also review our adherence to established IT and cybersecurity controls.


text: Despite our efforts, cyber attacks, unauthorized access or security breaches, or other cyber incidents such as computer viruses, malicious or destructive code, ransomware, social engineering attacks, hacking, denial-of-service attacks, and other similar attacks could materially affect us and disrupt our business. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. Potential consequences of a successful cyber attack or cybersecurity breaches or incidents could, however, include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues resulting from the unauthorized use of proprietary information or the failure to retain or attract customers following an attack, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. For more information about the cybersecurity risks we face, see the risk factor titled "We are significantly dependent on information technology and our business may suffer from disruptions associated with information technology, cyber-attacks or other catastrophic losses affecting our IT infrastructure" in Item 1A. Risk Factors.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of standards. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that assesses and manages material risks from cybersecurity threats and determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks, including the monitoring and detecting of cybersecurity incidents and executing our cybersecurity incident response plans. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.


text: the privacy of customer and personnel information is important to us, and we maintain security protocols and processes, including ongoing training and education for all personnel, designed to combat the risk of unauthorized access or inadvertent disclosure.

companyName: Electromed, Inc.

ticker: ELMD


text: Our business operations involve confidential information, including patient health information subject to regulation as discussed under " HIPAA, HITECH and Other Privacy Regulations " above. Our information technology infrastructure is designed to offer reliability, scalability, performance, security and privacy for our personnel, clients, and third-party contractors.


text: Risk Management and Strategy have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework. The cybersecurity risk management program is integrated into our Enterprise Risk Management (ERM) program.


text: cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents;


text: regulatory-based risk assessments for the Company's systems and applications (where formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident;


text: information security training program for all employees, including phishing awareness of third-party service providers to conduct assessments of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing.


text: date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.


text: Audit Committee and the Board of Directors provide oversight of cybersecurity risk management. The cybersecurity risk management program is co-led by senior leaders of our management and third-party service providers. Between our senior leaders, there is a combined 30+ years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our Director of IT leads the IT organization, reports directly to the Chief Financial Officer and works closely with the President and Chief Executive Officer to guide strategic direction and IT decisions to drive business outcomes. Our Board of Directors is engaged in the Company's Enterprise Risk Management (ERM)


text: program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Audit Committee oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee and Board of Directors receives regular updates on the Company's cybersecurity risk management program from the Chief Financial Officer, Director of IT and third party managed service provider CISO.


text: Risk Management and Strategy We have implemented a cybersecurity risk management program based on multiple cybersecurity frameworks, primarily the National Institute of Standards and Technology Cybersecurity Framework (800-171), as well as information security standards issued by international bodies. We use this program, which is integrated into our overall enterprise risk management framework, to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SANMINA CORP

ticker: SANM


text: We employ various measures to help manage our cybersecurity risks, including end-to-end email encryption, two-factor authentication for access to Company applications, strong password requirements and firewall and email protection against malware and phishing campaigns. We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. Our program includes processes designed to identify material risks related to the use of third party service providers, such as cloud service providers.


text: We provide cybersecurity and information security compliance training to relevant employees at least once per year, tracking completion and requiring testing, and conduct simulated phishing campaign tests. We also provide additional specialized training for our security team and for employees with access to certain sensitive information.


text: Our SCI Technology subsidiary has been certified under the U.S. Cybersecurity Maturity Model Certification (CMMC) program. We also engage third-party experts to improve our cybersecurity posture, including through penetration testing.


text: We have adopted a cybersecurity and privacy incident reporting framework to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, assessment of public disclosure considerations and reporting to the Audit Committee and the Board.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors - Cyberattacks and other disruptions of our information technology network and systems could interrupt our operations, lead to loss of our customer and employee data and subject us to damages."


text: Our Board has primary responsibility for overseeing risks associated with our information technology, including cybersecurity. Our Board receives regular reports from our Chief Information Officer ("CIO") regarding our information systems and technology and associated policies, processes and practices for managing and mitigating cybersecurity and technology-related risks. Our Audit Committee oversees our SEC reporting process generally, including with respect to any required disclosures relating to a material cybersecurity event.


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports directly to our Chief Executive Officer.


text: Our Vice President, IT Security is an experienced cybersecurity professional with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams, and holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.


text: Our SCI subsidiary has been certified under the U.S. Cybersecurity Maturity Model Certification (CMMC) program. We also engage third-party experts to improve our cybersecurity posture, including through penetration testing.


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports to our Chief Financial Officer.


text: Our Vice President, IT Security is an experienced cybersecurity professional with more than 10 years of experience building and leading cybersecurity, risk management, and information technology teams, and holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: RISK MANAGEMENT AND STRATEGY We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is informed by industry-wide recognized standards, such as The National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.


text: On an ongoing basis we conduct cybersecurity risk assessments, including compiling, reviewing, and acting on information garnered from internal stakeholders, known security vulnerabilities, and data from external sources. The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: We routinely assess our systems and processes for modifications in advance of evolving state privacy regulations and other applicable industry standards and regularly update our privacy and information security policies to remain current with industry-leading practices. We are continually adapting to the ever-changing cyber risk landscape and have a dedicated team of information security professionals committed to maintaining the highest levels of systems and data security. The Company conducts and has engaged external information security firms to conduct assessments, including penetration tests, to continually improve security controls and ensure security controls. We continue to expand and grow our security team and their skillsets and make regular enhancements to our Information Security Program.


text: In addition, we engage with our third-party business partners to enforce our internal cybersecurity practices. We rely on all third-party business partners to maintain appropriate security programs; however, we cannot ensure in all circumstances that their efforts will be successful. We assess third-party cybersecurity controls through a detailed cybersecurity assessment and review and include security and privacy addendums to our contracts, where applicable. We also require that our third parties report material cybersecurity incidents to us, allowing us the ability to assess the impact of any reported incident on our operations.


text: Additionally, we developed a business continuity and disaster recovery program to help minimize the impact from certain types of cybersecurity risks. The Company's incident response plans include emergency response, systems recovery, and other plans that would be enacted in the event of certain types of cybersecurity attacks. Our business continuity and disaster recovery plans are updated regularly and tested each year or as needed.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with diverse expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.


text: Management's Role A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), have responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.


text: Our Compliance Committee members have decades of business and leadership experience managing risk, including cybersecurity risks, that collectively enables them to effectively oversee comprehensive cybersecurity risks. Our CIO has served in various roles in information technology for more than 30 years, including serving as a chief information officer for a technology company, and has a degree in information management systems. Information Security Program leaders and Team Members who support our Information Security Program have relevant educational and technical certifications, such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP), and applicable industry experience, including cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance. For further details about our CIO's background, see the "Information About Our Executive Officers" section of Item 1 of this annual report on Form 10-K.


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.


text: RISK MANAGEMENT AND STRATEGY We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is guided by industry-wide recognized standards, including The National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Identity security to include multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with a broad range of expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.


text: Management's Role A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), has responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.


text: The Company is susceptible to a variety of risks as an inherent part of serving our clients' needs, including risks related to cybersecurity, data privacy and technology. The Company maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program, which balances serving the interest of our clients, their policyholders and customers, regulatory bodies, our investors, our employees and other relevant constituencies, is integrated within the Company's Enterprise Risk Management ("ERM") program.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: The underlying controls of the cybersecurity program are based on recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. RGA periodically engages a third party to perform an assessment of the Company's cybersecurity risk management program against the NIST framework.


text: RGA utilizes third-party partners, including leading national and international companies specializing in cybersecurity and software development, to supplement its security operations team to provide monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. The Company also engages third party partners to assist in evaluating and testing the Company's cybersecurity infrastructure. These partners are subject to the Company's third party due diligence process that includes security and privacy assessments, legal reviews, and ongoing assessments and performance reviews to ensure compliance with the Company's policies and standards.


text: Both the board of directors and management have an active and ongoing role overseeing, assessing, identifying and managing material risks from cybersecurity threats.


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The CRO and Global Chief Information Security and Privacy officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, data privacy, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.


text: The Company's risk management process and strategy, including cybersecurity risks, is the responsibility of the CRO and is supported by the Company's Risk Management Steering Committee ("RMSC"), which includes senior management executives, including the President and Chief Executive Officer ("CEO"), the Chief Financial Officer ("CFO"), and the Chief Investment Officer, among others. The RMSC provides oversight and advises the CRO on the Company's enterprise risk management framework and strategic risk exposures including cybersecurity risks. The Company's CISO and CRO provide updates through quarterly meetings with the RMSC.


text: The CRO, Chief Information Officer ("CIO") and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security and privacy teams ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, data privacy, operational risk management, and information technology, including regulatory compliance and risk quantification.


text: A cross functional team, including Finance, Legal, Risk and the Information Technology departments, in conjunction with others as needed, are involved in the materiality assessment of cybersecurity threats and incidents. The factors considered in the assessment of materiality include, but are not limited to, the probability of an adverse outcome, actual and expected direct and indirect costs stemming from the incident, the possibility of litigation or regulatory investigations, and the nature and extent of harm to policyholders, cedents, vendor relationships, and the Company's reputation and competitiveness. Conclusions are reviewed and approved by the Company's CEO, CFO and CRO.


text: We have experienced, and may in the future experience, whether directly or through third parties, cybersecurity incidents. While prior incidents, including those previously disclosed and not disclosed, have not materially affected our results of operations or financial condition, we cannot assure that they will not be materially affected in the future by such incidents. Additionally, although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A – "Risk Factors."


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The Chief Information Officer ("CIO") and Global Chief Information Security Officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.


text: The CRO, CIO, and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security team ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, operational risk management, and information technology, including regulatory compliance and risk quantification.


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program.

companyName: ALLSTATE CORP

ticker: ALL


text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements. In addition, the CISO provides updates to senior leadership, the Audit Committee and the Allstate Board, as appropriate.


text: Jeffrey Wright is senior vice president and CISO for Allstate. He is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. Mr. Wright has more than 20 years of information security leadership experience.


text: Risk Management and Strategy The Enterprise Risk and Return Council has delegated the power and authority to manage cybersecurity risks to the Information Security Council ("ISC"). The CISO chairs the ISC, with senior management representation from across the Company including representatives from Privacy, Legal and Technology. The ISC monitors, makes mitigating decisions about, and escalates information security risks that are outside the Company's established risk tolerance. Additionally, it provides executive sponsorship of information security controls and oversees the development and review of the information security policy and enterprise security standards.


text: Allstate evaluates candidates for information security positions based on experience and qualifications. Senior leadership, team leads and subject matter experts conduct interviews to identify top candidates who represent the technical and behavioral acumen required of cybersecurity professionals at Allstate. Allstate provides cybersecurity employees with continuing education associated with their roles and responsibilities.


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies The Allstate Corporation 31 Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: Allstate conducts risk and control assessments to proactively identify and assess the likelihood and impact of specific information security risks using the NIST CSF. The Company conducts these risk assessments at multiple levels of scope, including applications, business processes, business units, and enterprise. Allstate documents the identified risks, tracking them based on potential impact and the likelihood that harm might occur. The Company manages the risks in accordance with its Information Security Program.


text: Allstate's Information Security Program outlines the responsibilities and expectations for the security of Allstate information systems. The Program includes standards, policies and procedures requiring the implementation of technical, administrative and physical controls to manage the risk to Allstate information and systems. These standards, policies and procedures cover industry-standard information security domains, including risk assessment, third-party supplier risk management, vulnerability management, identity and access management, application security, network security, cybersecurity awareness training, encryption and incident management.


text: Allstate conducts periodic assessments, designed to evaluate effectiveness of implemented controls. The Company performs vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.


text: Dedicated personnel support information security operations 24 hours per day, seven days per week. Allstate's incident response program is designed to detect, respond and recover from a range of cybersecurity-related incidents.


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program (the "Program").


text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements.


text: Our CISO is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. He has more than 20 years of information security leadership experience.


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: Allstate conducts risk and control assessments to proactively identify cybersecurity threats impacting the organization's business processes. The Company conducts enterprise threat-based risk assessments for multiple aspects of the business, including applications, infrastructure, environments and business processes. Allstate documents the identified risks, tracking them based on potential impact and the likelihood of them occurring.


text: Allstate performs control effectiveness tests, vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.


text: We also have a cybersecurity resiliency strategy that will enhance our ability to anticipate, withstand and recover from cybersecurity attacks and maintain the availability of our critical business operations. Cybersecurity resiliency plans improve our recovery speed to protect Allstate and its customers against adverse impacts due to ransomware and other cybersecurity events.


text: Cybersecurity Risk Management and Strategy Air Wisconsin's approach to mitigating information technology ("IT") and cybersecurity risk is comprised of a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of its critical IT Systems and information related to its business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, Air Wisconsin has aligned its cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Air Wisconsin assesses its cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that it meets any particular technical standards, specifications or requirements, only that it uses the NIST CSF as a guide to help it identify, assess and manage cybersecurity risks relevant to its business.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: Air Wisconsin's cybersecurity risk management processes include a cybersecurity incident response plan, and it has invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to its IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom Air Wisconsin may share data, and regular system reviews and security exercises. Air Wisconsin's cybersecurity risk management program is a component of its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Air Wisconsin works closely with accredited third-party cybersecurity firms to audit its security architecture. Air Wisconsin's Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing its cybersecurity risk assessment processes, its security processes, and its response to cybersecurity incidents. For the year ended December 31, 2023, Air Wisconsin has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect it, including its operations or business strategy or our results of operations or financial condition. Air Wisconsin faces certain ongoing risks from cybersecurity threats that, if realized, could materially adversely affect it, including its operations or business strategy or our results of operations or financial condition.


text: Cybersecurity Governance The Company considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to Air Wisconsin. Certain individuals within Air Wisconsin, including its Chief Financial Officer and Vice President of Information Technology ("IT Management") oversee the design, implementation and enforcement of our cybersecurity risk management program, including a cybersecurity policies and procedures manual. IT Management is supported by Air Wisconsin internal security staff and external experts as part of its continuing education on topics that impact public companies. Air Wisconsin's Vice President of Information Technology has more than 15 years of experience managing and leading IT and cybersecurity teams. IT Management is responsible for efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. In the event of a breach or incident, the cybersecurity policies and procedures manual requires notification to Harbor's board of directors.


text: Risk Management and Strategy We employ a comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: VORNADO REALTY LP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.