text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must include approval by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.


text: • Employee training: Information security is an integral component of our employee training program. Training includes efforts to maintain security awareness among employees at all times by means of company-wide communications of cybersecurity risks or incidents affecting third parties, internal testing and similar efforts.

companyName: RENASANT CORP

ticker: RNST

secItem: Item 1C


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to its clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.


text: Strategy and Testing. As mentioned above, the Company employs a layered, defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity and to report on any suspected threats. These controls include appropriate access controls based on least privilege, multifactor authentication for remote and privilege access, and encryption to protect data. The information security program is designed to comply with applicable laws and regulations and is driven by industry standards for financial institutions, including the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, as well as by the guidance promulgated by the National Institute of Standards and Technology ("NIST"). We work closely with government and industry associations to stay abreast of developments and share best practices with respect to cybersecurity. The following paragraphs describe how we test, or otherwise obtain feedback about, the Company's cybersecurity and other information security. The feedback we develop through testing and assessment, in addition to information about cybersecurity threats or incidents impacting other entities, is incorporated into the Company's information security program to enhance our cybersecurity; in certain circumstances a new or emerging cybersecurity threat may require modifications to how we conduct business.


text: The Company's information security team utilizes the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security version of the FFIEC Cybersecurity Assessment Tool to perform an annual assessment of our information security program. The assessment provides a repeatable and measurable process for institutions to measure their cybersecurity preparedness over time. The assessment incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the NIST Cybersecurity Framework.


text: The assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The Cybersecurity Maturity aspect of the assessment is designed to help management measure the institution's level of risk and corresponding controls. The levels range from baseline to innovative. Cybersecurity Maturity includes tests to determine whether an institution's behaviors, practices and processes can support cybersecurity preparedness within the following five domains: • Cyber risk management and oversight • Threat intelligence and collaboration • Cybersecurity controls • External dependency management • Cyber incident management and resilience We also retain third parties to test the effectiveness of our cybersecurity efforts. Annually, we obtain independent third party audits of the information security program, including program maturity and overall control effectiveness. In addition, multiple times over the course of each year we engage third party security firms to conduct both external and internal penetration tests. The goal of these assessments is to discover vulnerabilities in the Company's in-scope corporate networks. When testing reveals potential vulnerabilities in the Company's security, management works to develop appropriate mitigation plans to resolve any outstanding issues; we also consider other recommendations to enhance our cybersecurity that these security firms may offer, implementing those that management concludes are appropriate within the context of the Company's information security program and processes. In addition to audits and testing by third party security firms, our information security program and infrastructure is subject to continuous supervision by the FDIC and the DBCF, including an annual in-depth examination by subject-matter experts from the FDIC and DBCF. The laws and regulations that these regulators administer impose very high expectations on the Company with respect to its information security policies, procedures, processes and controls. In particular, the Interagency Guidelines Establishing Information Security Standards (the "Guidelines") require us to implement a comprehensive written information security program that includes administrative, technical and physical safeguards designed to (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (4) ensure the proper disposal of customer information and consumer information. We also must comply with the information sharing requirements and restrictions enacted pursuant to the GLBA. The regulators' continuous supervision of the Company is designed to ensure, among other things, that our information security program meets all the standards set forth in the Guidelines and that we operate in compliance with the GLBA and all other applicable information security laws and regulations. Finally, in addition to external scrutiny, our internal audit department reviews our compliance with the Guidelines, the GLBA and other laws and regulations, including those related to information security. If any of these examinations identify deficiencies or areas for improvement, the Company's information security team works with management to act as promptly as reasonably possible to address the action item resulting from any such examination or review.


text: Diligence of Vendors and Other Third Parties. As noted above, the Company's information security program applies to our vendors and other third parties (referred to collectively as "vendors") with access to our information systems and networks and/or confidential and proprietary information. Before we grant access to the Company's systems or a vendor otherwise obtains access to the Company's confidential and proprietary information, our information security team assesses the vendor's information security program. We review the vendor's information security policy (to the extent the third party is willing to provide a copy of such policy), information security audits, service organization reports and similar information as well as examination reports of the vendor if available from the banking regulators or other governmental entities; the team will also investigate the background, reputation and history of prior cybersecurity incidents of such vendor or other third party. If the information security team is not satisfied that the vendor's information security infrastructure is adequate to reasonably protect the Company's systems and confidential and proprietary information from unauthorized access, and there are no suitable solution to address the information security team's concerns, then we will not engage such vendor.


text: The vendors we retain are also categorized by the level of risk that the vendor presents to us, of which information security risk is a component. The information security team annually reviews those vendors in the "high risk" category and periodically reviews other vendors. This review includes obtaining updated information security audits and service organization reports, where available, and otherwise analyzing whether the vendor's cybersecurity risk profile has materially changed.


text: The information security team's review process does not, and cannot, guarantee that a Company vendor will not suffer a cybersecurity incident that impacts us. Due to the possibility that a vendor's information security may be breached, we also negotiate provisions in vendor contracts that address cybersecurity incidents. In addition to including provisions that address the parties' relative responsibility for damages resulting from a cybersecurity incident at a vendor, these contracts also typically include provisions to ensure that the Company receives timely and complete notification of a cybersecurity incident and cooperation in responding thereto so that we can assess the extent of the incident's impact on the Company's systems or information, mitigate any adverse effects arising therefrom and comply with any customer or regulation notification requirements and other legal, regulator or contractual obligations.


text: Incident Response. For those situations where a cybersecurity threat or incident arises, whether internal to the Company or relating to one of its vendors, we have also organized an incident response team. The incident response team includes representatives from the information technology, operations, risk management, legal (including securities law counsel), privacy and finance departments, among others. In addition to meeting quarterly, the incident response team (or a subset of the team) gathers whenever there is a threatened or actual breach of the Company's information security (whether involving an external actor or an internal party) to determine the nature and extent of the threatened or actual breach and, if appropriate, the steps to take in response thereto to protect the Company's information security and mitigate any harm that has already occurred. The team is also responsible for ensuring the Company complies with legal and regulatory requirements (including notifying affected customers and regulators and making any filings required by the securities laws). The activities of our incident response team are reported to the Board's Enterprise Risk Management Committee. The Company also maintains a cyber insurance policy that provides cyber liability coverage.


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2023, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.


text: Governance and Oversight Management Role. The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing as to the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).


text: The efforts of our information security team to address cybersecurity risk are reviewed by the Company's Risk Department, which oversees our enterprise risk management program. The department focuses on the quality of the Company's risk management process in order to manage risks within acceptable tolerance levels. As it pertains to cybersecurity risk, the Risk Department challenges the processes that the information security team has implemented to identify, assess, control and mitigate cybersecurity risk. The department collaborates with the CISO and other business unit owners impacted by our cybersecurity risk management practices to develop and monitor controls and other processes that mitigate identified risks. In addition, the Risk Department conducts independent risk evaluations related to cybersecurity risk.


text: The primary means by which the Risk Department evaluates cybersecurity risk is the development, in conjunction with the information security team, of risk metrics related to cybersecurity as well as risk tolerances with respect to each such metric. Risk tolerances are set such that the overall cybersecurity risk presented to us is consistent with the risk appetite statement adopted by our Board annually. Management believes these metrics provide a holistic picture of the Company's cybersecurity risk profile, but at the same time, we recognize that, given the continual evolution of cybersecurity risks, including the tools and vectors that bad actors take to compromise a company's information security, our risk metrics cannot remain static. At least annually, the Risk Department meets with the CISO to assess whether the risk metrics, and the tolerances for each metric, remain appropriate in light of the Company's operations and the cybersecurity threat environment.


text: As the third line of defense against cybersecurity risk, our Internal Audit Department, with the assistance of outside experts, annually reviews and tests the Company's processes, including its policies, procedures and controls, with respect to cybersecurity risk. The Internal Audit Department reports the results of its review, including the steps management intends to take to address any findings, to the Audit Committee of the Board of Directors.


text: Finally, as a means to ensure that our senior executive management has an integrated understanding of the cybersecurity and other risks facing the company at any particular time, the Company has organized a Management Enterprise Risk Management Committee (the "management ERM committee"). Our Chief Risk Officer leads this committee, whose membership includes the Company's President and the leaders of our major business lines and back-office functions. Among other things, the management ERM committee reviews the Company's cybersecurity and other risk metrics and the direction in which each risk is trending (increasing risk or decreasing risk), both in isolation and in the context of other existing and emerging risks facing the company, and the status of risk mitigants therefor. We believe that this committee helps management better focus its efforts to minimize cybersecurity risk and that it assists in more focused reporting of cybersecurity risks to the Board of Directors.


text: Board Oversight. The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee"). These committees meet quarterly, and their activities are reported to the full Board of Directors.


text: The Technology Committee is responsible for the oversight of Renasant's strategies and operations with respect to information technology. Although this committee's focus is broader than just information security and cybersecurity risk, at each meeting the CISO reports to the committee on, among other topics, the status of any cybersecurity and network security initiatives designed to enhance the Company's cybersecurity, emerging cybersecurity risks that may not yet be addressed by the existing risk metrics and management's plans to mitigate such risks, and employee training on cybersecurity and related issues.


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. At each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the direction such metric is trending. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee is included the materials for ERM meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, at each ERM Committee meeting our Chief Technology Officer addresses various information technology topics with the ERM Committee.


text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must be approved by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to our clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee") oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2024, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.


text: Governance and Oversight Management Role. The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context of the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).


text: Board Oversight. The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and the ERM Committee. These committees meet quarterly, and their activities are reported to the full Board of Directors.


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. The Company tracks numerous risk metrics relating to cybersecurity, and at each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the metric's trend of increasing or decreasing risk. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee described above is included the materials for ERM Committee meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, the CISO attends ERM Committee meetings, providing additional detail, and answering committee members' questions, about the CISO's report.


text: ACNB recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data. Governance of cybersecurity risk is based on the Corporation's Information Security Program and related policies and procedures, which are designed in conformance with industry standards and compliance with Section 39 of the Federal Deposit Insurance act and sections 501 and 505(b) of GLBA, and to protect the confidentiality, integrity and availability of its information assets. The Corporation's Board of Directors is responsible for overseeing the development, implementation and maintenance of the Corporation's overall information security standards. The Audit Committee of the Board of Directors has enterprise risk management oversight responsibilities, which includes information security. Information Security-related functions are performed by both ACNB Bank Risk Management and Technology Services personnel. The Information Security Committee is an ACNB Bank management committee which is responsible for providing oversight and direction for information security matters and standards and meets periodically throughout the year with minutes of their meetings provided to the Corporation's Board of Directors. ACNB Bank's Information Security Officer is responsible for managing and monitoring the Information Security Program, and is a part of the Risk Management department, which ultimately reports to the Chief Risk Officer. Additionally, the Information Security Program is supported by ACNB Bank's Technology Services Department which is led by the Technology Services Manager who reports to the Chief Credit and Operations Officer.

companyName: ACNB CORP

ticker: ACNB


text: The Information Security Program includes Information Security strategy, an incident response plan for incident management; access rights management; threat and vulnerability management; security training; risk and maturity assessments; security systems controls and standards; data use, reproduction, storage and destruction standards, intrusion prevention management, patch management, physical and environmental protections, encryption standards, malicious code prevention, intelligence sharing, and Information Security Monitoring, including architecture considerations, activity monitoring and condition monitoring. On an annual basis, Information Security-related risk assessments and a maturity analysis are performed and reported to the Board of Directors or the Board Audit Committee. Risks from cybersecurity threats associated with use of third-party service providers are addressed as part of the vendor management program, in initial and ongoing assessment of service providers. Information Security training is conducted for both employees and the Board of Directors annually. Training includes sharing educational communications to increase employee awareness of cybersecurity risks.


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Security for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.


text: As a regulated financial institution, ACNB Bank is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation" included in Part I. Item 1 – Business of this report.


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done via electronically, and this has increased its risks related to cybersecurity." and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security." included in Part I. Item 1A. – Risk Factors of this report.


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Detection and Response for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. Platforms are in place with the ability to automate containment without the risk of employee response delays and a third party provider performs additional external vulnerability scanning, network threat detection and automated containment, risk analysis and continuous monitoring. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done electronically, and this has increased its risks related to cybersecurity". and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security". included in Part I. Item 1A. — Risk Factors of this report.


text: The Corporation maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Corporation's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Corporation's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: PENNS WOODS BANCORP INC


text: As part of the Corporation's overall risk management processes, the board of directors has established both a senior management Risk Management Committee and a separate senior management Information Technology Steering Committee. Each of these Committees meets regularly and consists of the Corporation's senior management department heads, plus the Chief Executive Officer and the President and Chief Financial Officer of the Corporation (each of whom also serves as a director of the Corporation). The Information Technology Steering Committee reports directly to the board of directors, with the Corporation's Chief Information Officer ("CIO") presenting to the board a detailed report on information systems and cybersecurity matters at least once annually. The board of directors also receives and reviews copies of minutes of all meetings of both the Risk Management Committee and the Information Technology Steering Committee.


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-nine years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.


text: The Corporation maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the board of directors when appropriate. The Incident Response Plan is managed by the Information Technology Department, including the ISO, and is reviewed and tested at least annually.


text: The Corporation uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Risk Management Committee has established risk management guidelines for third-party vendors. The Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Corporation's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Corporation may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Corporation shares with such providers.


text: To date, the Corporation has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by the Corporation to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, the Corporation may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented the Corporation's cybersecurity controls and procedures are, and the Corporation may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: RISK MANAGEMENT AND STRATEGY We have implemented a cybersecurity program to address all levels of cybersecurity threats based on our determination of the risk level. Our program includes policies and procedures that dictate the method in which we develop, deploy, and maintain security measures and controls. We use a cybersecurity framework to select security controls to protect against identified risks. When designing the controls, we consider the severity of risk and its impact on the Company, including the cost of the control and the impact it may have on the Company operations. We use various combinations of controls and tools to mitigate the risk to the Company such as firewalls and intrusion devices, endpoint threat detection systems, multi-factor authentication systems, endpoint threat detection systems as well patch management to prevent exploitable vulnerabilities.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: We utilize third-party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: We maintain a written incident response plan and carry out periodic tabletop exercises to improve incident response readiness. Employees undergo security awareness training when hired and periodically thereafter; the scope of this training is continually updated to address newly identified threats. We utilize a risk-based approach and analysis to determine the cybersecurity controls to implement, and hence, there is a possibility that these controls may not adequately address every risk if we do not identify or place a high enough risk factor on a given threat. We are at risk of zero-day attacks and other vulnerabilities that may have been placed at a very low risk. In addition, even well-designed and properly deployed controls may not fully eliminate a given risk.


text: CYBERSECURITY THREATS We have not had any cybersecurity incidents that we believe have materially affected or are likely to materially affect the Company. GOVERNANCE.


text: Board Member Guy W. Adams serves as our Lead Technology and Cyber Risk Director. In December 2017, Mr. Adams was recognized as a Governance Fellow for the National Association of Corporate Directors, The Gold Standard Director Credential. In 2018, Director Adams completed the Cyber-Risk Oversight course presented by the National Association of Corporate Directors.


text: We utilize third -party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Chief Digital Officer ("CDO") and VP of IT, Director, and President. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: REGIS CORP

ticker: RGS


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • Cybersecurity awareness training of our employees; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Our CDO directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy.


text: We have not historically been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business.


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Director of Information Security, Vice President of IT, our President and our Board of Directors. The Audit Committee receives periodic reports on the Company's cybersecurity measures, protections, response plans, etc. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.


text: Our Director of Information Security directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. Our Director of Information Security has more than 35 years of relevant IT experience, including 20 years directly managing information security, holds professional certifications including ISC(2)'s Certified Information Systems Security Professional (CISSP—issued 2006) and ISACA's Certified Information Security Manager (CISM—issued 2006), and has ongoing involvement in various professional organizations, including serving for the last 15 years on the governing body of the Gartner/Evanta Minneapolis CISO summit, and is a member of the Minnesota chapter of ISACA.


text: Murphy's cybersecurity environment is led by the Company's Information Technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is responsible for monitoring and managing security of the corporate network and enterprise systems, including developing and deploying policies, technical controls, and safety protocols and responding to security threats. All members of the MCT hold globally recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active threats and incidents as they occur. The Chief Information Officer is a member of the IMT, and regularly provides briefings to the Chief Executive Officer, the executive leadership team, and the Audit Committee of the Board. The Audit Committee is ultimately responsible for ensuring that management has processes in place to identify and evaluate cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.

companyName: MURPHY OIL CORP

ticker: MUR


text: Murphy considers its protection from cybersecurity threats to be a core component of its overall enterprise risk management system. Murphy's cybersecurity risk management framework consists of cyber readiness, cybersecurity governance, and risk management strategy. The cybersecurity risk management framework is incorporated into the overall enterprise risk management process through policies, procedures, periodic simulations, and constant monitoring of the cybersecurity environment for new and emerging threats. The Company also requires employees to receive regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third party advisors, industry groups and policymakers.


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics.


text: Murphy utilizes industry leading technologies that focus on continuous monitoring and analytics built on machine learning and artificial intelligence to safeguard against sophisticated cyberattacks. Deployed technologies include next generation firewalls, advanced endpoint and email protection, multi-factor authentication and Managed Detection and Response. In addition to the monitoring and detection processes for its own IT systems, Murphy also has processes in place to identify cybersecurity threats associated with third party service providers and partners; these processes include industry information sharing groups, cybersecurity notification services, vendor risk assessments, and ongoing collaboration with federal agencies.


text: Murphy has not experienced any material impacts to our business, operations, or reputation due to cyberattacks or other security-related incidents. However, we recognize cyber threats are constantly evolving and are committed to cultivating a culture of security, remaining vigilant and continually improving our cybersecurity environment and controls.


text: Murphy's cybersecurity environment and risk strategy is broadly managed by the Company's Information Technology (IT) group, which oversees the Company's IT and Operational Technology (OT) infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is specifically responsible for monitoring and managing security of the enterprise IT and OT network and systems, including developing and deploying administrative policies, technical controls, and safety protocols necessary to prevent unauthorized access, theft, damage, or loss of Company data or systems. All members of the MCT hold globally-recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active security threats and incidents as they occur. The Chief Information Officer oversees the IT group and is a member of the IMT, and provides briefings to the CEO, the executive leadership team, and the Audit Committee of the Board regarding cybersecurity risks, strategy, and management at least annually. The Audit Committee is ultimately responsible for overseeing cybersecurity strategy and ensuring that management has sufficient resources, programs, and processes in place to identify, evaluate, manage, and mitigate relevant cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board as appropriate. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.


text: Murphy considers its cybersecurity risk management framework to be a core component of its overall enterprise risk management system. The cybersecurity risk management framework directly aligns with the National Institute of Standards and Technology Cybersecurity Framework and involves regular review and update of security policies and procedures; leverage of industry-leading technologies focused on continuously monitoring, analyzing, and defending against intrusions; regular testing of such technologies and other controls; periodic simulations of security incidents; and constant monitoring of the broader cybersecurity environment for new and emerging threats. The Company also requires employees to attend regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third-party advisors, industry groups and policymakers.


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics. In addition to monitoring its own IT systems, Murphy also has processes in place to identify cybersecurity risks and threats associated with third party service providers and partners. These processes include conducting vendor due diligence and risk assessments, participating in industry information sharing groups, subscribing to cybersecurity notification services, and maintaining ongoing collaboration with federal agencies.


text: To our knowledge, Murphy has not experienced any cybersecurity incidents that have had, or are likely to have, material impacts to our business, operations, finances, or reputation.


text: Cybersecurity Risk Management & Strategy Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Arrow has implemented and regularly reviews and updates its internal controls and procedures as well as corporate governance policies and procedures intended to protect its business operations, including the security and privacy of the confidential information of its customers. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its back-up systems. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.


text: Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.


text: Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.


text: Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and our enterprise risk management group all have a role in the cybersecurity risk management program.


text: Regulatory Supervision Arrow and its subsidiaries are subject to the provisions in the Gramm-Leach-Bliley Act relating to data security, as well as many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity.


text: In July 2023, the SEC adopted amendments intended to enhance and standardize disclosures related to cybersecurity. The amendments were effective in December 2023 and require timely disclosure of material cybersecurity incidents and annual disclosures related to cybersecurity risk management, strategy, and governance. Under the new rules, a material cybersecurity incident is required to be disclosed on a Form 8-K within four business days after the learning of a material incident. The SEC has defined a cybersecurity incident to mean "an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein." Arrow has undertaken and implemented a number of procedures and control steps to comply with these expanded cybersecurity reporting requirements as outlined below.


text: Cybersecurity Risk Management & Strategy Arrow has implemented processes designed to oversee and identify risk from cybersecurity breaches. Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems.


text: Arrow also regularly reviews and updates its existing internal controls and procedures and corporate governance policies and procedures intended to protect its business operations, which includes the security and privacy of the confidential information of its customers. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and the Enterprise Risk Management ("ERM") committee at the senior management level all have a role in the cybersecurity risk management program. The Board receives periodic reports from the ERM committee, which is chaired by the Director of Compliance and Risk and includes executive, senior, and other designated managers as appropriate.


text: The Company's information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees', customers' and end users' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: Apyx Medical Corp

ticker: APYX


text: The outsourced Chief Information Security Officer ("CISO") works closely with the Chief Financial Officer to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Apyx Medical has established a separate committee comprised of the CISO, Chief Financial Officer, Outside Counsel, Chief Executive Officer, and Department Heads, if necessary. This committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and CFO present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: a. Protecting data through the use of automated and manual processes; b. Periodically assessing and updating the program to address an evolving threat environment;

companyName: S&T BANCORP INC

ticker: STBA


text: c. Maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and d. Ensuring business continuity and disaster recovery.


text: We based and tailored our framework on the National Institute of Standards and Technology, or NIST, Cybersecurity Framework and the Center for Internet Security, or CIS, Critical Security Controls.


text: The S&T Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect the bank's assets. We encrypt and leverage data loss prevention technology for sensitive data and use advanced transport layer security encryption for our applications. S&T employees are required to undergo annual information security awareness training, which includes information regarding evolving threats such as phishing, malware and social engineering testing.


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: a. Identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident;


text: b. Assessing the likelihood and potential impact of those threats; and c. Assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third-party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the Chief Security Officer, or CSO, continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset) and regulators in a timely manner based on the criticality of the cybersecurity incident. S&T also has in place incident response and business continuity plans. The Incident Response Program outlines the policies, procedures and technical measures for identifying an incident, assessing its nature and scope, minimizing and containing the impact, investigating the root cause and reporting, as applicable. S&T uses data from incidents to reassess risk, evaluate and implement any additional controls deemed necessary and measure the success of the incident response team. The Incident Response Program also includes staff training, annual updates and testing. The Business Continuity Plan defines the policies, procedures and technical measures to restore systems and critical operations. S&T also maintains business continuity plans for critical systems and applications managed or hosted by third-party vendors.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, Chief Information and Technology Officer and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.


text: Management's Role At the management level, the ERM Committee, CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 17 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Chief Information and Technology Officer has nine years of information technology and cybersecurity experience. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 10 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: • protecting data through the use of automated and manual processes; • periodically assessing and updating the program to address an evolving threat environment; • maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and • ensuring business continuity and disaster recovery.


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: • identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident; • assessing the likelihood and potential impact of those threats; and • assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2024, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.


text: Management's Role At the management level, the ERM Committee, CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 18 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 11 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.


text: Risk Management and Strategy We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.

companyName: KEY TRONIC CORP

ticker: KTCC


text: Risks from cybersecurity threats, including as a result of the Previously Disclosed Cyber Incident, have materially affected us, including our results of operations and financial condition. We continue to face risks from this and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Risk Factors – Technology Risks."


text: Our Board of Directors is responsible for the oversight of risk management for the Company, including the review and assessment of the Company's enterprise risk management approach and processes. Our Board of Directors has delegated certain responsibility for the oversight of risks from cybersecurity threats to the Audit Committee. At each regularly scheduled quarterly meeting, and more frequently as necessary, management provides updates to the Audit Committee and our Board of Directors regarding the risks from cybersecurity threats. These updates include information regarding cybersecurity strategies, management structure, mitigation activities and an analysis of any actual or potential cybersecurity incidents.


text: Our management team, including our Chief Executive Officer and Executive Vice President of Quality and Information Systems, is responsible for assessing and managing our material risks from cybersecurity threats. In particular, our EVP of Quality and Information Systems, who reports directly to our Chief Executive Officer, oversees the implementation of controls designed to prevent, detect, mitigate and recover from cybersecurity threats and cybersecurity incidents. Our current EVP of Quality and Information Systems has a Bachelor of Science degree in Mechanical Engineering and over 14 years of experience building and executing information system strategies. The other members of our management team do not have specialized information systems or cybersecurity backgrounds but have general experience managing financial, legal and operational risks. Our EVP of Quality and Information Systems, along with his team, routinely monitors the Company's information systems for cybersecurity threats and will be notified upon the occurrence of a potential cybersecurity incident.


text: Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, management will inform the Audit Committee and/or our Board of Directors and, if the incident is deemed material, will disclose the incident pursuant to SEC rules and regulations.


text: Risk Management and Strategy We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise- wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") program. As part of our ERM program, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk management" section of this Form 10-K for additional information on our approach to risk management, including our governance framework. Refer to "Item 1A - Risk Factors" of this Form 10-K for additional information on our cybersecurity risks.


text: Cybersecurity risk management process Our Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to our network, infrastructure, computing environment, and to third parties. We periodically assess the design of our cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and we seek to implement improvements to our controls in response to that assessment. Our Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect our clients', associates', and firm data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, and providing appropriate public disclosure of cybersecurity risks and incidents when required. In addition, we maintain a global training program for our associates about cybersecurity risks and requirements and conduct regular phishing email simulations in order to test our associates' understanding of these risks.


text: Our cybersecurity strategy takes a defense-in-depth approach, with layered controls consisting of both commercially available and proprietary technologies that are intended to prevent an adversary from conducting a successful attack. Included in that approach is our Cyber Threat Center which is a critical component of our Cybersecurity Program and operates internally with the purpose of monitoring, detecting, and responding to cyber threats that could jeopardize the integrity, confidentiality, or availability of information systems. Our Cyber Threat Center operates 24 hours per day, 7 days per week, continuously monitoring our systems for signs of tampering or unauthorized activity, utilizes an incident response playbook which is based on NIST industry best practices, and includes containment and recovery procedures. Furthermore, we maintain cybersecurity insurance coverage which provides certain limited protection.


text: In conjunction with third-party vendors and consultants, we perform a variety of periodic risk assessment initiatives to gauge the performance of the Cybersecurity Program, to estimate our risk profile, and to assess compliance with relevant regulatory requirements. We perform periodic assessments of control efficacy through our internal risk and control self-assessment process, a variety of cyber event simulation exercises focused on the effectiveness of our incident response and crisis management procedures, and external technical assessments, including external penetration tests and "red team" engagements where third parties test our defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls.


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a supplier risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our supplier risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.


text: We also maintain business continuity plans that include identification of critical functions, third-party suppliers, and personnel. Our information technology department executes several disaster recovery exercises per year in order to test our capabilities and ensure that business recovery needs could be met during a real-world event. Additionally, our information technology department participates in annual crisis management exercises to test our operational responses and assess our preparedness for various scenarios, including cyber incidents. We also participate annually in industry-wide and internal exercises to test our response capabilities.


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party vendors, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.


text: The Board of Directors has designated its Risk Committee to assist it in overseeing management's responsibility to implement an effective risk management framework designed to identify, assess, and manage key risks, including cybersecurity risk. As part of our ERM program, executive management, with review and oversight of the Risk Committee, establishes key risk indicators to measure ongoing alignment with the firm's risk appetite and tolerance levels related to cybersecurity risk. Risk appetite and tolerance thresholds are periodically reviewed by management and approved by the Risk Committee. The Risk Committee receives regular presentations and reports from our Chief Information Security Officer ("CISO"), which address a wide range of cybersecurity risk topics, including emerging threats and recent developments, cybersecurity policy and standards updates, vulnerability assessments, risk assessment outcomes (including third-party and independent reviews), technology trends, and information security considerations arising with respect to the firm, our peers, and third-party vendors. Additionally, the Board of Directors receives reports at least annually on the performance of the firm's cybersecurity risk metrics.