text: Our Senior Director and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Senior Director and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading the implantation of the cybersecurity risk management program and working directly with our security team. The Senior Director and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.


text: Our Senior Director and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB

secItem: Item 1C


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Vice President and Head of Information Technology who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, including through annual third-party vulnerability assessments. We train our employees on these safeguards, in collaboration with human resources, IT, and departmental management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have established procedures to evaluate and respond to cybersecurity incidents, including cybersecurity incidents at third-party service providers which have a potential to impact our data and systems. Our cybersecurity risk management is intended to address such risks, as well as other risks related to third parties.


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, " Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is to provide oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Vice President and Head of Information Technology and our cyber committee, which includes Facilities, HR, IT, Legal, and Management, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Vice President and Head of Information Technology has years of cybersecurity experience and expertise including holding numerous applicable cybersecurity certifications, such as ISC2 Certified Information Systems Security Professional (CISSP).


text: Our Vice President and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading cybersecurity risk management and working directly with our IT team. Our Vice President and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.


text: Our Vice President and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk Management and Strategy Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and maintain partnerships with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.

companyName: Axos Financial, Inc.

ticker: AX


text: We may utilize various resources that we deem necessary based on actual or potential threats and vulnerabilities to Axos, including engaging independent third-party assessors, consultants and/or auditors to help evaluate the effectiveness of our cybersecurity risk management program, processes, and controls.


text: Our overall enterprise risk management includes a third-party risk management program, through which we identify, monitor, and manage cybersecurity risks inherent in or related to external service providers and other third parties. Through our business lines, we actively assess and oversee our third-party service providers against requirements set by our third-party risk management program and our cybersecurity risk management program.


text: We have not identified any cybersecurity incidents that have materially affected Axos or its business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks which may materially affect the Company in the future. Refer to the Risk Factors section for additional information.


text: Our Board of Directors includes cybersecurity risk management as part of its general oversight function and oversees the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receive regular updates from management on cybersecurity.


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program, including oversight of our cybersecurity risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.


text: The individuals involved in our cybersecurity risk management program are informed about developments in cybersecurity risks and related matters through a variety of channels inside the Company, including but not limited to, briefings from internal teams and alerts and reports produced by various measures we may deploy, as well as information obtained from external sources in the government and private sector, including external third party consultants retained by Axos.


text: Our Chief Information Security Officer and Chief Risk Officer report information on cybersecurity risks to the Board of Directors on a regular basis.


text: Risk Management and Strategy Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and collaborate with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.


text: Cybersecurity risk management is part of our Board of Directors' general oversight function, which includes oversight of the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receives regular updates from management on cybersecurity.


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.


text: Risk Management and Strategy To mitigate cybersecurity risks we strive to continually assess and improve our processes and procedures. We engage with industry-leading managed security service providers to supplement our efforts in identifying, assessing, preventing, and responding to cybersecurity threats. We are working to align our information technology operations and information security processes to the National Institute of Standards and Technology's framework. We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks and is currently being integrated into our overall enterprise risk management process. We regularly assess our cybersecurity vulnerability by utilizing credible, third-party cybersecurity experts to conduct annual internal penetration tests and monthly vulnerability scans. These threat intelligence and monitoring activities, tests, and scans help us identify potential cybersecurity risks.


text: We seek to mitigate cybersecurity risks we identify through a variety of methods; however, we acknowledge that even a robust, well-designed information technology control environment may not fully eliminate cybersecurity risk. It is possible that we will be unable to detect certain vulnerabilities in time to remediate them, or that our implemented controls may not operate as intended.


text: To date, we have not experienced any material cybersecurity incidents. We remain subject to the risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity as part of its risk oversight function. While management is responsible for the day-to-day management of risk, our Board of Directors maintains oversight of management's implementation of our cybersecurity risk management processes. Our Board of Directors receives briefings on material cybersecurity incidents, as necessary.


text: Our Vice President of Information Technology provides principal oversight and guidance of our cybersecurity risk management strategy, programs, and processes. The Vice President of Information Technology has over 30 years of experience in information technology, leading organizations through strategic technology and process improvement initiatives, including over 15 years of extensive experience in cybersecurity. He is supported by a team of technical experts who have received formal training and possess relevant experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.


text: As part of our annual enterprise risk assessment, technology cybersecurity risks are ranked and reviewed by management. In the event of a cybersecurity incident, the Vice President of Information Technology would prepare a comprehensive assessment for management that summarizes potential and actual impacts and includes any steps needed to remediate the identified issues. If the cybersecurity incident was deemed to be material by management, the Vice President of Information Technology would brief our Board of Directors on the matter, at which time determinations would be made by the Board of Directors on the need to report or disclose the cybersecurity incident to our customers or investors.


text: Risk Management and Strategy To mitigate cybersecurity risks, we continuously assess and enhance our security processes and procedures. We collaborate with industry-leading managed security service providers to strengthen our ability to identify, assess, prevent, and respond to cybersecurity threats. Our information technology operations and security processes are being aligned with the National Institute of Standards and Technology (NIST) framework to further standardize and improve our security posture.


text: As part of our commitment to a cloud-first strategy, we prioritize the use of SaaS-based solutions for critical business functions. These third-party providers conduct annual Statement on Standards for Attestation Engagements ("SSAE") audits, ensuring compliance with industry best practices.


text: We have adopted a cybersecurity risk management framework designed to identify and mitigate potential cybersecurity risks, which is being integrated into our overall enterprise risk management program. Our risk assessments are informed by third-party cybersecurity experts, who conduct annual internal penetration tests and monthly vulnerability scans to continuously evaluate and strengthen our security posture.


text: Cybersecurity risks are categorized using a Critical, High, Medium, and Low risk scoring methodology. These assessments are performed through a combination of automated tools, manual audits, and expert evaluations, allowing us to implement effective controls that enhance our security framework. In addition, we have introduced annual cybersecurity awareness training, phishing simulations, and ongoing communication initiatives to strengthen organizational awareness of cybersecurity risks and threat prevention. To date, we and our subsidiaries have not experienced any material cybersecurity incidents.


text: Cybersecurity is a key component of our enterprise risk oversight framework, with our Board of Directors actively engaged in overseeing cybersecurity risk management. While management is responsible for day-to-day cybersecurity operations, the Board ensures that our cybersecurity risk management strategies are effectively implemented. The Board is briefed on material cybersecurity incidents as necessary to maintain transparency and informed decision-making.


text: Our Vice President of Information Technology leads our cybersecurity strategy, programs, and risk management processes. With over 30 years of experience in IT, including 15+ years in cybersecurity, the Vice President provides strategic oversight and ensures alignment with industry best practices. This role is supported by a team of cybersecurity professionals with formal training and specialized expertise, as well as partnerships with managed security service providers focused on proactive threat detection, incident response, and risk mitigation.


text: As part of our annual enterprise risk assessment, cybersecurity risks are ranked and reviewed by executive management. In the event of a cybersecurity incident, the Vice President of Information Technology, in collaboration with our cybersecurity partners, would conduct a comprehensive impact assessment. This assessment would outline both potential and actual risks, along with necessary remediation steps. If an incident is deemed material, the Vice President would escalate the matter to the Board of Directors, who would determine whether disclosure to customers or investors is required.


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business processes and decision-making across the Company. Our information technology is connected to support the flow of information across our business processes. As such, our information technology infrastructure is susceptible to cybersecurity threats.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: We maintain detailed technology and cybersecurity programs to manage information security risk within the Company. We rely on both proprietary and commercially available systems, software, and tools to protect and monitor the processing, transmission, and storage of company data and both customer and team member information. The objectives of our programs are to: • protect the confidentiality, integrity, and availability of data, • protect against anticipated threats, • protect against unauthorized access to our information technology systems, • safeguard assets, and • maintain resiliency and recovery plans regarding Company informational technology.


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 27 years of cybersecurity experience, 25 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.


text: Our cybersecurity programs are informed by or aligned to the ISO/IEC 27001 security framework, an internationally recognized standard. As part of our programs, we assess our third-party vendors for relevant risks which may impact the Company.


text: We also engage third-party providers to perform periodic risk-based assessments of our cybersecurity programs, and also leverage our internal audit department, supported by third-party technical experts, to conduct periodic risk-based audits of our cybersecurity programs.


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets regularly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.


text: The Audit Committee of the Board of Directors has oversight responsibility for ERM, including the cybersecurity programs. The CISO provides regular updates on cyber security to the Audit Committee, including on the cybersecurity aspects noted by the ERM Committee and CPS Committee, and regularly meets with the Audit Committee in executive session. The presentations highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business." for more detailed information on cybersecurity risks and the potential impacts.


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 28 years of cybersecurity experience, 26 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets quarterly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business" for more detailed information on cybersecurity risks and the potential impacts.


text: Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following: • A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts. • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks. • Continuous and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, periodic audits of our systems by outside industry experts and regular vulnerability scanning. • Engaging external cybersecurity experts in incident response development and management. • Business continuity plans and critical recovery backup systems.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: The Company's cyber risk management program is supervised by a dedicated Chief Information Officer whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program. We provide regular awareness training to our employees, including periodic phishing tests, to help identify, avoid and mitigate cybersecurity threats. We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.


text: CYBERSECURITY INCIDENT RESPONSE PROCESS We maintain and actively update a cybersecurity incident response plan that outlines the steps we take to identify, investigate and take action in response to any potentially material cyber incidents. Our incident response plan ensures that our Chief Information Officer, members of our senior management team and select members of our legal staff, are timely informed of and consulted with respect to any potentially material cyber incidents.


text: BOARD OVERSIGHT OF CYBER RISK Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. The Chief Information Officer presents regular updates to the Audit Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: We face a number of cybersecurity risks in connection with our business. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.


text: Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following: • A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts. • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to identify, protect, detect, respond and recover from cyberattacks. • Real-time and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, disaster recovery, periodic audits of our systems by outside industry experts and continuous vulnerability scanning. • Engaging external cybersecurity experts in incident response development and management. • Business continuity plans and critical recovery backup systems. • Maturity assessment and roadmap to sustain/improve security posture based on risk profile.


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. The Chief Information Officer presents regular updates to the Audit Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, and the status of projects in the Company's multi-year roadmap to strengthen the Company's information security systems to address the emerging threat landscape. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect critical assets, scale with business growth, identify and mitigate threats, and enable us to conduct our business securely. The program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Our cybersecurity risk management program includes: • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • ongoing risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Information Officer, Senior VP Global IT Operations and IT Security Director, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The cybersecurity team leads dedicated cybersecurity meetings with the Chief Corporate Governance & Compliance Officer and key members of the legal and compliance department. This group meets monthly and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. The leadership of our cybersecurity team averages approximately 25 years of experience with information technology, with a background deeply rooted in data management and protection and data analytics and brings extensive experience in information security strategy and risk management at Houlihan Lokey and in previous roles.


text: The audit committee receives regular reports from management on our cybersecurity risks. In addition, management updates the audit committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The audit committee reports to our full board of directors regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management on our cyber risk management program.


text: The cybersecurity management team, including our Chief Information Officer, Executive VP IT Operations and IT Security Director, is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The cybersecurity team leads dedicated cybersecurity meetings with the Chief Corporate Governance & Compliance Officer and key members of the legal and compliance and internal audit departments. This group meets monthly and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. The leadership of our cybersecurity team averages approximately 26 years of experience with information technology, with a background deeply rooted in data management and protection and data analytics and brings extensive experience in information security strategy and risk management at Houlihan Lokey and in previous roles.


text: We have implemented and we maintain a cybersecurity program that includes a well-defined set of security controls and measures designed to identify, assess, and manage material cybersecurity risks. The cybersecurity program is a part of our broader enterprise risk management program which includes risk assessment, third party risk management, risk mitigation strategy and a clearly defined incident response methodology. The program is led by our executive officers, with support from a working group of senior management with functional and operational expertise. Oversight for this program is provided by the Audit Committee of the Board. Each quarter our executive officers review matters, including any cybersecurity matters, that may present material risks to our strategy, mission or objectives, and where appropriate, engage third parties to conduct assessments of the risks and gaps that require attention. Risk events are classified based on the evaluated likelihood of the risk materializing and its potential impact on the enterprise, and for each material risk a definitive risk mitigation strategy is developed, executed, and shared with the Audit Committee and the Board by our Chief Legal Officer and Corporate Secretary, working closely with our Chief Financial Officer and head of Information Technology, at least quarterly to ensure appropriate monitoring and management of the relevant risks. To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.

companyName: Anterix Inc.

ticker: ATEX


text: Risk Management and Strategy We have implemented and we maintain a cybersecurity program that includes a well-defined set of security controls and measures designed to identify, assess, and manage material cybersecurity risks.


text: The cybersecurity program is a part of our broader enterprise risk management program which includes risk assessment, third party risk management, risk mitigation strategy and a clearly defined incident response methodology. The program is led by our executive officers, with support from a working group of senior management with functional and operational expertise.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of Information Technology ("IT"), who reports directly to our Chief Financial Officer. Our Director of IT has more than 20 years of experience working with enterprises to protect their systems from cybersecurity risks and to address other areas of risk management. We also engage other consultants and third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Oversight for this program is provided by the Audit Committee of the Board. Each quarter our executive officers review matters, including any cybersecurity matters, that may present material risks to our strategy, mission or objectives, and where appropriate, engage third parties to conduct assessments of the risks and gaps that require attention. Risk events are classified based on the evaluated likelihood of the risk materializing and its potential impact on the enterprise, and for each material risk a definitive risk mitigation strategy is developed, executed, and shared with the Audit Committee and the Board by our Chief Legal Officer and Corporate Secretary, working closely with our Chief Financial Officer and Director of IT, at least quarterly to ensure appropriate monitoring and management of the relevant risks. To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.


text: Cybersecurity Threat Disclosure To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.


text: Cybersecurity Risk Management and Oversight Strategy for Management of Cybersecurity Risk Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: Celanese Corp

ticker: CE


text: We identify, assess, manage and mitigate cybersecurity risk through a risk management program based on the NIST Cybersecurity Framework that is regularly assessed by a third party cybersecurity consultant. As part of our processes, we perform routine scanning and have an established vulnerability management program and patching policy. We have in our learning management system a comprehensive cybersecurity awareness course that is mandatory for all employees with computers and covers key topics such as identifying workplace cybersecurity hazards and attacks, and our separate CyberSAFE and Data Privacy intranets provide content to help employees identify and avoid cybersecurity and data privacy risks. We also have data privacy educational tools, policies and procedures to help employees prevent, recognize and report data privacy incidents. We perform penetration tests and vulnerability and breach assessments with third-party advisors to support our compliance with laws and regulations including those applicable to chemical manufacturing sites. We also have a third-party risk management program with a formal approach to evaluating and managing risks associated with third-party information technology solutions and software. We maintain cyber/information security insurance to protect against certain expenses and liabilities that may be incurred in the event of an incident.


text: Cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures.


text: Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.


text: Governance and Oversight Primary responsibility for assessing and managing risks from cybersecurity threats resides with our management team, including a Chief Information Officer who has nearly 30 years of information technology experience including leadership roles at multiple large, global and/or publicly-traded companies, and a Chief Information Security Officer who has over 30 years of experience in cybersecurity with large international publicly-traded companies and who holds a Certified Information Systems Security Professional (CISSP) certification. These individuals, together with others on their teams, are informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management policies, processes and operations discussed above. They regularly report to and consult with the executive leadership team on such matters.


text: At the Board level, the full Board and its Environment, Health, Safety, Quality and Public Policy ("EHSQPP") Committee (which oversees many of our operational risks related to manufacturing) are both involved in oversight of the Company's management of cybersecurity risk. Management, including the Chief Information Officer and Chief Information Security Officer, updates our EHSQPP Committee and full Board on cybersecurity matters quarterly. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board.


text: Additional Information For additional information on the risks we face related to cyber and information security threats, please see the risk factors in Item 1A. Risk Factors titled "Production at our manufacturing facilities, or at our suppliers', could be disrupted for a variety of reasons, which could prevent us from producing enough of our products to maintain our sales and satisfy our customers' demands" on page 19 and "We are subject to information or operational technology cybersecurity threats that could materially affect our business" on page 22.


text: Cybersecurity Risk Management and Oversight Strategy for Management of Cybersecurity Risk Cybersecurity, resilience and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud, business interruption and violation of privacy or security laws.


text: Cybersecurity, resilience and data privacy risks are maintained and managed on an ongoing basis as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity, resilience and data privacy) is designed to assess, identify and manage cybersecurity- resilience and data privacy-related risks and mitigation measures.


text: Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident and integrates with our enterprise crisis management program.


text: At the Board level, the full Board and its Stewardship Committee (which oversees many of our operational risks related to manufacturing) are both involved in oversight of the Company's management of cybersecurity risk. Management, including the Chief Information Officer and Chief Information Security Officer, updates our Stewardship Committee and full Board on cybersecurity matters quarterly. We also have processes by which certain cybersecurity incidents are escalated within the Company and may be reviewed by a designated management committee and, where appropriate, reported in a timely manner to the Board.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for essential third-party service providers, suppliers, and vendors, as identified by management.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology ("VP IT") or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the VP IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team has experience with implementing IT organizational policies and procedures, working in multiple platform environments, and overseeing corporate networking and hardware framework.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our internal team; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition. See "Part I, Item 1A. Risk Factors" contained in this Annual Report for a discussion of the risks we face from cybersecurity threats.


text: Our VP IT, who reports to the Chief Financial Officer, is primarily responsible for assessing and managing our material risks from cybersecurity, as well as our overall cybersecurity risk management program, including supervision of our retained external cybersecurity consultants. Our management team has experience with implementing IT organizational policies and procedures, working in multiple platform environments, and overseeing corporate networking and hardware framework.


text: Our VP IT and management team are informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our internal team; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Management and Strategy Our approach to cybersecurity risk is based on processes that monitor threats, adapt our capabilities and services, and align our practices with business goals in order to provide security controls that reduce information security risk to the organization and customers.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: We implement and maintain controls and capabilities for identifying, assessing, and managing risk from cybersecurity threats to the confidentiality, integrity, or availability of our information systems or any information residing therein. We also carry out broad-scope initiatives and project-specific initiatives aimed at continuously improving our cybersecurity posture. Our risk assessments and initiatives include identification of reasonably foreseeable internal and external risks, assessing the likelihood and potential impact that could result from such risks, and planning and implementing risk management controls as applicable. As a result, we adapt safeguards and processes in order to reduce identified risks in our security posture. Our cybersecurity processes form a part of our overall risk management practices and inform our annual enterprise risk assessment conducted by our internal audit team.


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. Our CISO and information security team also develop and implement policies and best practices related to product security. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby OptiView in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. In fiscal 2025, Dolby Atmos for cars achieved TISAX certification, a global information security standard for the automotive industry. We also take part in periodic security audits by our clients and partners.


text: As part of our overall risk management processes, our employees at all levels are trained on foundational cybersecurity practices annually, and periodically participate in various activities aimed at increasing their awareness of cybersecurity threats and reinforcing their understanding of our security policies.


text: Periodically, we engage consultants and other third party service providers in connection with our cybersecurity practices. These service providers assist us in event monitoring, conduct testing and provide feedback on our readiness and compliance, conduct tabletop exercises, and are "on-call" in the event of a significant event. We have implemented a third-party risk management process that we use to evaluate the capabilities and security posture of third-party service providers. As part of that process, we review third-party service providers to ensure that they have implemented appropriate security measures in connection with their work with us. We have not encountered any cybersecurity incident that had a material impact on our operations or financial standing.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A "Risk Factors" in this annual report on Form 10-K, under the heading "Operations."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee, which has responsibility for overseeing the adequacy and effectiveness of our cybersecurity and information security programs and policies according to its charter.


text: Our CISO is primarily responsible for assessing and managing our risks from cybersecurity threats. Our CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity strategy and operations, incident response, cybersecurity education and awareness, threat management, insider threats and regulatory compliance. Our CISO has over 25 years of experience in technology, with more than 15 years in information security, holding multiple roles including five years as a CISO for a health insurance company. Our CISO reports on cybersecurity risk management and other matters to our CIO, who in turn reports to our Chief Executive Officer. Along with our CISO our security, privacy, audit, risk and compliance council ("SPARC Council"), which is a collection of stakeholders from various functions including cybersecurity, legal, IT, engineering, finance, procurement and audit, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our CISO and our SPARC Council review the results of assessments, including security simulations and tabletop exercises, and discuss and recommend improvements to our policies and processes. In addition to the general reporting structure applicable to our CISO, the other members of the SPARC Council report on those activities through the reporting lines applicable to them, as needed.


text: Our CISO along with our CIO typically provide quarterly briefings to the Audit Committee regarding our company's cybersecurity risks and activities, including recent cybersecurity incidents and strategy development. The findings from our annual enterprise risk assessment are also presented to the Audit Committee by our internal audit team. Our Audit Committee provides regular updates to the Board of Directors on such reports. In addition, our CISO along with our CIO typically provide annual briefings directly to the Board of Directors on cybersecurity risks and activities.


text: Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks aimed at our information systems and networks, including those that store sensitive data about third parties. We have established a Global Information Security Program, which is administered and overseen by the Company's Chief Information Security Officer ("CISO"), that establishes minimum requirements we adhere to in order to provide a secure environment for developing, implementing, and supporting our information technology and systems. Our Global Information Security Program is designed to maintain compliance with various regulatory requirements and certification standards, including those under HIPAA, HITECH, PCI, ISO, SOC and SOX, as we aim to have world-wide, generally accepted, best practices.

companyName: WEX Inc.

ticker: WEX


text: Periodic assessments of the Global Information Security Program are conducted to ensure it is well-positioned to meet its objective of reducing the threat of known and emerging cybersecurity risks, as well to confirm ongoing compliance with legal and industry best practices and standards. Assessments of the program are continuously conducted by management and by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS and HITRUST, in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the Board (the "Technology Committee"), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective. The Technology Committee, pursuant to its charter, is responsible for the oversight of the Company's management of risks regarding technology, data security, cybersecurity, disaster recovery and business continuity. To perform this function, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company's CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. The Technology Committee then, in turn, regularly reports out to the full Board and the Audit Committee as necessary during succeeding meetings to keep them informed. In addition, members of senior management, including the Chief Technology Officer ("CTO"), the CISO, and the Chief Legal Officer ("CLO") correspond directly with, or present to, the full Board, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. We believe the members of our senior management responsible for assessing and managing material risks from cybersecurity threats and interfacing with the Board and Board Committees on such matters collectively possess the appropriate expertise and experience from both a technical and governance perspective to ensure that they are able to carry out these responsibilities effectively. In particular, our CISO has spent over 30 years in various information security roles, including serving as the CISO of WEX since March 2014. Additionally, he holds professional degrees in the areas of Computer and Information Systems Security and multiple ISACA and ISC2 certifications (CISM, CISA, CRISC, CISA and CISSP). Our CTO has spent over 25 years in various engineering and technology roles, including serving as Chief Technology Officer for two other companies prior to joining WEX. In his past roles he was responsible for implementing product and technology initiatives and gained extensive experience in payments technology, technology infrastructure, technical engineering, AI, and machine learning.


text: Additionally, he holds a professional degree in Computer Science. Our CLO has been with WEX since 1996, serving as the Corporate Secretary and head of the Legal department since 2005. In this capacity, she has gained extensive experience coordinating with the Board on addressing numerous emerging risk areas and ensuring our governance processes are equipped to manage and mitigate such risks. In addition to the processes we have put in place to ensure our information systems and networks continue to evolve and adapt to the ongoing cybersecurity threat environment, we have designed an enterprise security architecture system that deploys layers of security controls to continuously monitor for potential cybersecurity vulnerabilities and threats in a situation when a potential incident does arise. Our systems are configured to generate alerts in the event of any potential breach or intrusion with a team in place to receive and act upon such alerts. Additionally, all WEX systems that store, process, transmit, or could affect the security of confidential data are logged and monitored, with our information security team conducting a daily review of any such systems. If an alert is triggered automatically by our system or as a result of our team's review and a potential cyber or information security incident is detected, the alert will be elevated within the information security incident response team and the CISO will become responsible for informing the crisis management team to facilitate the Company's assessment and response to the potential incident. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. Furthermore, the crisis management team, in conjunction with members of senior management will determine whether to engage third parties, including outside counsel, consultants, law enforcement and external forensic firms, to provide support in the assessment of and response to the incident.


text: Additionally, we have policies and procedures in place to help oversee and identify material risks from cybersecurity threats associated with third-party service providers. Prior to engaging vendors, specifically those involved in the processing, storage or transmission of certain data, the information security team completes a due diligence process, including requiring proof of the potential vendor's PCI, HIPPA, HITRUST, and/or SOC 2 compliance, as applicable. During the due diligence process the information security team assigns a risk ranking as it relates to information security risk and may perform additional due diligence if appropriate based on such ranking. Further, we engage an external vendor risk monitoring and alert service to monitor the cyber health of our third-party vendors. If there is a change in the vendor's risk profile, we review the risk and initiate an action plan in response, which could include additional monitoring, remediation requests or termination. If the vendor is a key technology vendor and/or a vendor with access to protected data, any action plan will be escalated to the CISO and require the CISO's approval before proceeding.


text: We view our Global Information Security Program and the processes followed thereunder as just one part of our overall enterprise risk management strategy. As part of our annual enterprise risk management review, we identify and categorize risk areas across our business, including technology risks and those related to cybersecurity. We determine the magnitude of such risks in the context of our overall business and how the technology risks, including cybersecurity specifically, may have an impact on other risks the Company faces and vice versa to help us inform our overall risk management strategy going forward. This allows us to continuously assess cybersecurity risks in alignment with our strategic objectives and operational needs.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, there is no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations or financial condition in the future. See Part I – Item 1A – Risk Factors – "We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability and damage to our reputation. Our efforts to implement robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access."


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks aimed at our information systems and networks, including those that store sensitive data about third parties. We have established a Global Information Security Program, which is administered and overseen by the Company's Chief Information Security Officer ("CISO"), that establishes minimum requirements we adhere to in order to provide a secure environment for developing, implementing, and supporting our information technology and systems. Our Global Information Security Program is designed to maintain compliance with various regulatory requirements and certification standards, including those under HIPAA, HITECH, PCI, ISO, SOC and SOX, as we aim to have world-wide, generally accepted, best practices.


text: Periodic assessments of the Global Information Security Program are conducted to ensure it is well-positioned to meet its objective of reducing the threat of known and emerging cybersecurity risks, as well to confirm ongoing compliance with legal and industry best practices and standards. Assessments of the program are continuously conducted by management and by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS and HITRUST, in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the board of directors (the "Technology Committee"), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective. In addition to the processes we have put in place to ensure our information systems and networks continue to evolve and adapt to the ongoing cybersecurity threat environment, we have designed an enterprise security architecture system that deploys layers of security controls to continuously monitor for potential cybersecurity vulnerabilities and threats in a situation when a potential incident does arise. Our systems are configured to generate alerts in the event of any potential breach or intrusion with a team in place to receive and act upon such alerts. Additionally, all WEX systems that store, process, transmit, or could affect the security of confidential data are logged and monitored, with our information security team conducting a daily review of any such systems. If an alert is triggered automatically by our system or as a result of our team's review and a potential cyber or information security incident is detected, the alert will be elevated within the information security incident response team and the CISO will become responsible for informing the crisis management team to facilitate the Company's assessment and response to the potential incident. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. Furthermore, the crisis management team, in conjunction with members of senior management will determine whether to engage third parties, including outside counsel, consultants, law enforcement and external forensic firms, to provide support in the assessment of and response to the incident.


text: Additionally, we have policies and procedures in place to help oversee and identify material risks from cybersecurity threats associated with third-party service providers. Prior to engaging vendors, specifically those involved in the processing, storage or transmission of certain data, the information security team completes a due diligence process, including requiring proof of the potential vendor's PCI, HIPAA, HITRUST, and/or SOC 2 compliance, as applicable. During the due diligence process the information security team assigns a risk ranking as it relates to information security risk and may perform additional due diligence if appropriate based on such ranking. Further, we engage an external vendor risk monitoring and alert service to monitor the cyber health of our third-party vendors. If there is a change in the vendor's risk profile, we review the risk and initiate an action plan in response, which could include additional monitoring, remediation requests or termination. If the vendor is a key technology vendor and/or a vendor with access to protected data, any action plan will be escalated to the CISO and require the CISO's approval before proceeding.


text: The Technology Committee, pursuant to its charter, is responsible for the oversight of the Company's management of risks regarding technology, data security, cybersecurity, disaster recovery and business continuity. To perform this function, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company's CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. The Technology Committee then, in turn, regularly reports out to the full board of directors and the Audit Committee as necessary during succeeding meetings to keep them informed. In addition, members of senior management, including the Chief Technology Officer ("CTO"), the CISO, and the Chief Legal Officer ("CLO") correspond directly with, or present to, the full board of directors, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. We believe the members of our senior management responsible for assessing and managing material risks from cybersecurity threats and interfacing with the board of directors and board of director committees on such matters collectively possess the appropriate expertise and experience from both a technical and governance perspective to ensure that they are able to carry out these responsibilities effectively. In particular, our CISO has spent over 30 years in various information security roles, including serving as the CISO of WEX since March 2014. Additionally, he holds professional degrees in the areas of Computer and Information Systems Security and multiple ISACA and ISC2 certifications (CISM, CISA, CRISC, CISA and CISSP). Our CTO has spent over 25 years in various engineering and technology roles, including serving as Chief Technology Officer for two other companies prior to joining WEX. In his past roles he was responsible for implementing product and technology initiatives and gained extensive experience in payments technology, technology infrastructure, technical engineering, AI, and machine learning. Additionally, he holds a professional degree in Computer Science. Our CLO has been with WEX since 2021, serving as Chief of Staff to the CEO and as Vice President, Corporate Legal Services prior to that, before becoming the Corporate Secretary and head of the Legal department in 2024. In these roles, she has gained extensive experience coordinating with the Board on addressing numerous emerging risk areas and ensuring our governance processes are equipped to manage and mitigate such risks.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, there is no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations or financial condition in the future. See Part I – Item 1A – Risk Factors – "We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability, damage to our reputation, and other financial impacts. Our efforts to implement robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access."


text: Risk Management and Strategy We promote a company-wide culture of cybersecurity risk management to ensure that cybersecurity risk considerations are an integral part of decision-making at every level. We have implemented cyber defenses to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our information technology (IT) department continuously evaluates whether our cybersecurity risk management is aligned with our business objectives and operational needs. Our cybersecurity program is comprehensive in scope and covers the systems supporting our various lines of business.

companyName: Green Plains Inc.

ticker: GPRE


text: Our cybersecurity program follows the National Institute of Standards and Technology, as well as the Cybersecurity and Infrastructure Security Agency frameworks. Additionally, we follow federal and state statutory and regulatory guidance and have adopted internal policies and standards in alignment with these federal and state requirements. Furthermore, we collaborate with external experts, consultants and auditors in routinely evaluating and testing our information systems controls. We also perform an annual cyber table-top exercise with a regulatory agency to help us test and continue to develop our Cyber Incident Response Plan.


text: Our cybersecurity program includes a well-documented process for oversight of cybersecurity risks associated with our third-party service providers. We evaluate our third parties prior to any engagements. We also request System and Organization Controls reports from our third-party vendors to obtain reasonable assurance that their controls are present and functioning.


text: Our IT policies communicate our expectations of employees and contractors to maintain the security of our IT systems. We perform annual cyber security training to remind our employees about the importance of keeping our systems safe, and perform regular third-party phishing campaigns.


text: The Audit Committee of the Board of Directors has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, the company's IT leadership meets on a quarterly basis with the Audit Committee and on an annual basis with the company's Board of Directors. During these update meetings, IT leadership provides the Audit Committee and Board of Directors updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively encounter these threats.


text: Management continuously monitors the effectiveness of our cybersecurity defenses. We invest in regular and ongoing cybersecurity training for our IT department and company overall. Our Senior Vice President Business Technology has certain IT industry certifications and brings 30 years of IT background spanning all facets of technology, including applications, infrastructure and cybersecurity. Our Director of IT Security has over 20 years of experience in cybersecurity, including duties as an Information Security Officer in the United States Air Force.


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: Risk Management and Strategy We promote a company-wide culture of cybersecurity risk management to ensure that cybersecurity risk considerations are an integral part of decision-making at all organizational levels. To protect the confidentiality, integrity and availability of our data and information systems, we have implemented cyber defenses and continuously enhance them to address evolving threats. Our information technology (IT) department actively monitors and evaluates our cybersecurity practices to ensure alignment with our business objectives and operational needs. Our cybersecurity program is comprehensive in scope and covers the systems supporting all our business operations.


text: Our program is built on industry-standard frameworks, including the National Institute of Standards and Technology, and the Cybersecurity and Infrastructure Security Agency. We also follow applicable federal and state statutory and regulatory guidance and have adopted internal policies and standards in alignment with these federal and state requirements. Furthermore, we collaborate with external experts, consultants and auditors in routinely evaluating and testing our information systems controls. We also perform an annual pen-testing, cyber table-top exercise to help us test and refine our formal Cyber Incident Response Plan.


text: We maintain a well-documented process to oversee cybersecurity risks associated with our third-party service providers. We evaluate our third parties prior to any engagements and review their System and Organization Controls reports to obtain reasonable assurance that their controls meet our security standards.


text: Our IT policies communicate our expectations for employees and contractors regarding the security of our IT systems. We perform annual cyber security and technology processes training programs and regular third-party phishing campaigns to raise awareness of potential threats.


text: The Audit Committee of the Board of Directors has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, the company's IT leader meets on a quarterly basis with the Audit Committee and on an annual basis with the company's Board of Directors. During these update meetings, IT provides the Audit Committee and Board of Directors updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively counter these threats.


text: Management continuously monitors the effectiveness of our cybersecurity defenses. We invest in regular and ongoing cybersecurity training for our IT department and company overall. Our Senior Vice President Business Technology has IT industry certifications and brings over 30 years of IT background spanning all facets of technology, including applications, infrastructure and cybersecurity. Our Director of IT Security has over 20 years of experience in cybersecurity, including duties as an Information Security Officer in the United States Air Force.


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: To respond to the threat of security breaches and cyberattacks, we rely on a cybersecurity program developed by our Sponsor and Advisor, the implementation of which is led by our Sponsor's and Advisor's Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). The cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by them, or in their care. Our board of directors has oversight of cybersecurity risk, as indicated in the Company's proxy statement disclosure. Cybersecurity is reviewed as part of our and our Sponsor's and Advisor's overall enterprise risk management program. These are led by our management, our Sponsor's Director of Enterprise Risk Management and our Advisor's Global General Counsel, respectively and assess our significant enterprise risks, provide a summary of those risks and primary mitigations, and identify control improvement projects for our significant risks. The progress of control improvement projects for our Sponsor and Advisor risks are regularly reported to our management and on our risks to our board of directors. Our Sponsor's Director of Enterprise Risk Management regularly meets with their CISO and CIO to assess cybersecurity risks, cybersecurity program mitigants, and status of control improvement projects and our management and other employees of our Advisor regularly meet and communicate with our Sponsor's Director of Enterprise Risk Management, CISO and CIO.

companyName: JLL Income Property Trust, Inc.


text: Like other companies with a large technology footprint and high-profile client base, our Sponsor and Advisor are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations. In the future, it is possible such attacks could be successful and have a material impact on our operations. Our Sponsor's and Advisor's cybersecurity program strategy is to implement layered controls to reduce their and our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework.


text: Our Sponsor's CISO leads our cybersecurity program. Their CISO has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles for large global organizations and within the U.S. government and holds a master's degree in computer and network forensics. Their CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military, some of whom are dedicated to our Advisor.


text: Their CISO reports to their CIO who is responsible for the development and implementation of their and our technology, data and information management strategy. Their CIO has over twenty years of experience in technology, data management, data science and analytics. Before joining our Sponsor, their CIO previously held positions as Chief Data Officer, Global Head of Customer Intelligence, Head of Global Analytics and Head of Product Management for a large global financial services institution. Their CIO earned a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research.


text: Our Sponsor engages third-party consultants in connection with their and our cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. These third parties provide testing and advisory services to identify risks, improve the quality of controls, and respond to cybersecurity incidents.


text: Our Sponsor, Advisor and we regularly engage third parties to provide technology and/or to perform property management services, where they and we have imperfect visibility into those third parties' susceptibility to cybersecurity threats and/or their controls. To help address this risk, our Sponsor's cybersecurity program also includes assessments of cybersecurity threats associated with their, or Advisor's and our use of certain third-party service providers. They and our Advisor leverage pre-procurement security assessments and post-procurement continuous monitoring to evaluate the security risk of certain third-party service providers.


text: We, our Sponsor and Advisor maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident. They and we view cybersecurity as a shared responsibility, and they periodically perform simulations and tabletop exercises at a management level and incorporate external resources as well. They provide at least annual information security training program for our Advisor's employees who have access to Company related sensitive or personal information and regularly conduct phishing trainings.


text: We established a cyber incident management team that consists of our Sponsor's CIO, CISO, CFO, CLO and our CEO, CFO, General Counsel and Head of Marketing that is responsible for determining if a cybersecurity incident is material to us and requires disclosure. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification.


text: Although our Sponsor, Advisor, or we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in our "Risk Related to Our General Business Operations and Our Corporate Structure" in Part I, Item 1A of this report. Our business is highly dependent on our ability to collect, use, store and manage organizational data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our businesses, loss of investor or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack. As our Sponsor and Advisor outsource significant portions of their information technology functions to third-party providers, such as cloud computing, we bear the risk of them having less direct control over the security and performance of those systems.


text: Our cybersecurity risk is affected by cyber threats that are proliferating and advancing in their ability to identify and exploit vulnerabilities, requiring continuous evaluation and improvements to our security architecture and cyber defenses. We also face increased cybersecurity risk as our Sponsor and Advisor deploy additional mobile and cloud technologies. They are continuously hardening their infrastructure built on these technologies, monitoring for threats, and evaluating their capability to respond to any incidents to minimize any impact to their systems, data, or business operations, including those that impact us. Because our Sponsor services clients across multiple industry verticals many of which are higher-profile cyber targets themselves including financial services, technology, government institutions, healthcare and life sciences, this also may increase the risk that they and we are subject to cyber-attack incidents.


text: As noted above, our Sponsor, Advisor and we have experienced various types of cyber-attack incidents which thus far have been contained and not material to us. Our Sponsor and Advisor continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event. Our Sponsor also maintains a cyber risk insurance policy that provides coverage to us but the costs related to cybersecurity threats or disruptions may not be fully insured. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, our Sponsor, Advisor or other vendors or suppliers we engage, fall victim to other successful cyberattacks.


text: Our Advisor's management and our board of directors provide significant oversight of risks, including those from cybersecurity threats, and are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents applicable to us.


text: Our board of directors receives at least annual reports from our Sponsor's CISO and other members of our Advisor's management on our information security program including top cybersecurity risks, cybersecurity strategy, information system controls and related security measures and improvements, cyber incident response plan, cyber incidents and cyber defense metrics, and cyber security protocols and trainings.


text: Like other companies with a large technology footprint and high-profile client base, our Sponsor and Advisor are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations. In the future, it is possible such attacks could be successful and have a material impact on our operations. Our Sponsor's and Advisor's cybersecurity program strategy is to implement layered controls to reduce their and our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology cybersecurity framework.


text: Our Sponsor's CISO leads our cybersecurity program. Their CISO holds advanced qualifications and has extensive experience in cybersecurity. Their CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military, some of whom are dedicated to our Advisor.


text: Their CISO reports to their CIO who is responsible for their and our technology, data and information management strategy, and brings over two decades of relevant experience to the role.


text: Our Sponsor engages third-party consultants for assessing, identifying and managing material cybersecurity risks, including those associated with certain third-party providers. We and our Sponsor maintain a cyber incident response plan and regularly conduct simulations and tabletop exercises.


text: We established a cyber incident management team that consists of our Sponsor's CIO, CISO, CFO, CLO and our CEO, CFO, General Counsel and Head of Marketing that is responsible for determining if a cybersecurity incident is material to us and requires disclosure.


text: Our Sponsor maintains a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured. We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.


text: Cybersecurity risk management and strategy We have developed and implemented an enterprise-wide cybersecurity program, which is part of our overall risk management system and is designed to provide cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, proactive detection and mitigation of threats; protection of customer and internal confidential information; minimization of the impact of incidents; and identification, assessment, and management of material risks from cybersecurity threats.

companyName: Sonos Inc

ticker: SONO


text: We use a variety of strategies and techniques designed to identify cybersecurity risks and reduce the risk of unauthorized access to internal and customer confidential information and critical business systems and platforms. This approach utilizes both internal and external resources and includes regular risk assessments (for example, penetration testing and annual self-assessments), ongoing employee training, proactive monitoring of our IT systems, encryption of certain types of information, and certain controls governing access to our facilities and systems.


text: We maintain a detailed incident response plan to manage cybersecurity incidents when detected. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, cybersecurity software providers, and certain testing firms.


text: We have processes in place designed to identify and mitigate risks from third-party vendors, including, as appropriate, pre-contractual security assessments and review of contractual terms addressing cybersecurity and data protection.


text: To date, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion regarding risks related to cybersecurity threats, refer to Item 1A. "Risk Factors" of this Form 10-K.


text: Cybersecurity governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of our cybersecurity program to the Audit Committee. In connection with that oversight responsibility, senior members of our information security team meet with the Audit Committee on a regular basis (but no less than semi-annually) and provide information and updates on our cybersecurity program and related topics. This includes existing and new cybersecurity risks, status on how management is identifying, assessing, managing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, and developments in the cybersecurity space and evolving standards.


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our Head of Cybersecurity, Risk & Trust ("Head of Cybersecurity"). Our Head of Cybersecurity has almost 25 years of cybersecurity, information governance, and IT experience in the technology industry.


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our Head of Cybersecurity, Risk & Trust ("Head of Cybersecurity"). Our Head of Cybersecurity has over 25 years of cybersecurity, information governance, and IT experience in the technology industry.