text: The CSLT supervises our efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through a variety of means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and reports from cybersecurity systems deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program, which is designed to protect the confidentiality, integrity and availability of our critical systems and information, includes a comprehensive cybersecurity incident response plan.

companyName: Avery Dennison Corp

ticker: AVY

secItem: Item 1C


text: We design and assess our program based on the ISO 27000 and the National Institute of Standards and Technology (NIST) SP-800 and Cybersecurity Framework. We use these frameworks to help us identify, assess and manage cybersecurity risks relevant to our business and do not intend to suggest that we meet any particular technical standards, specifications or requirements.


text: Our cybersecurity risk management program complements our overall enterprise risk management program, using similar methodologies and governance processes to identify risks and mitigating strategies.


text: Our cybersecurity risk management program includes risk assessments designed to help identify potentially material cybersecurity risks to our critical systems, information, products and services, as well as our broader enterprise information technology environment; an information technology security team principally responsible for managing our cybersecurity risk assessment processes, security controls and response to any cybersecurity events; the use of third party experts and service providers, where appropriate, to assess, test and otherwise assist with protecting our security environment; cybersecurity awareness training for our employees and further training for our incident response personnel and senior management; a cybersecurity incident response plan that includes procedures for assessing and coordinating our response to cybersecurity events; and a third-party risk management process for service providers, suppliers and vendors.


text: Cybersecurity Governance Our Board of Directors (our "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for overseeing our cybersecurity risk management program and engaging with management on cybersecurity and other risks related to our information technology controls and security. Our Information Security Officer ("ISO") reports directly to our Chief Information Officer ("CIO"), a member of our Company Leadership Team and direct report of our Chief Executive Officer ("CEO"). The CIO and ISO together provide updates and discuss our cybersecurity preparedness with the Audit Committee at least semiannually, which its Chair then reports on to our full Board. Management updates the Audit Committee, if and as needed, regarding any significant cybersecurity events, as well as events that may have had lesser potential impact.


text: Our cybersecurity leadership team ("CSLT"), which includes leaders accountable for security operations, incident response, risk and compliance, data security, application security, digital solutions security, vulnerability management and operational technology security, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Information security personnel maintain a variety of technical and managerial security certifications and have broad security experience in manufacturing, finance, software and information technology environments.


text: The CSLT supervises our efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through a variety of means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and reports from cybersecurity systems deployed in our information technology environment.


text: We recognize the critical importance of cybersecurity in today's digital landscape and acknowledge the inherent risks associated with cyber threats. As such, cybersecurity is an integral component of our overall risk management strategy and corporate governance framework.

companyName: AZZ INC

ticker: AZZ


text: To meet business objectives, we rely on both internal information technology systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data that may be subject to legal protection, and to ensure the continuity of our supply chain.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of this program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Among the key elements of our cybersecurity risk management program are the following: • Security Awareness and Training - We use an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are provided annually to all employees. • Annual Risk Assessment - An annual risk assessment is conducted by a third party, which is designed to assess the effectiveness of the Company's security controls and to identify key risks. • Network Protection - Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections to segment different sections of the business from each other to strengthen key protection capabilities. • Identity and Access Management - We have implemented user authentication controls on the Company's systems, devices, data and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to systems and networks. • Penetration Testing – We have partnered with a third-party penetration testing company to help identify new vulnerabilities and continuously improve the security posture of the Company through annual testing. • Endpoint Detection and Response ("EDR") – EDR is an integrated, layered approach to endpoint protection that uses continuous monitoring and data analytics. We have partnered with a third-party security operations center, to provide critical support in monitoring, identifying and assessing cyber threats such as malware, ransomware, breaches, and denial of service attacks. • Security Incident Management - In the event of a cybersecurity incident, we have established an incident response plan, which outlines clear protocols for incident detection, containment, investigation, and resolution, aiming to minimize the impact on our operations, customers, and stakeholders.


text: We do not believe that any risks from cybersecurity threats, including any as a result of prior cybersecurity incidents we have experienced, have had a material adverse impact on our operations, business or financial condition. For more information regarding the risks we face from cybersecurity threats, see "Item 1A. Risk Factors."


text: Our approach to cybersecurity governance is embedded within the broader governance structure of the Company. The Audit Committee of the Board of Directors is tasked with reviewing our policies and procedures related to cybersecurity risks, including the Company's cybersecurity risk management program discussed above, to ensure their alignment with industry best practices and regulatory standards. The Audit Committee and the Board of Directors ("Board") regularly engages with management to assess cybersecurity risks, mitigation efforts, and the overall effectiveness of our cybersecurity program.


text: Our Director of Information Technology Infrastructure leads a dedicated management committee responsible for overseeing cybersecurity matters. The Information Security committee contributes decades of experience in technology, cybersecurity, architecture, and incident response in both military and private sector with certifications including Certified Information Systems Security Professional ("CISSP"), Certified Ethical Hacker ("CEH"), CompTIA Secure Infrastructure Specialist ("CSIS"), and degrees in cybersecurity, data science, and computer science. Collectively, this team has served in various large, publicly traded companies, implementing and managing robust IT and cybersecurity programs, developing tools, and safeguarding internal networks, business applications, customer-facing applications, and payment systems. This committee consists of members with diverse expertise, including information technology, legal, risk management and finance, who collaborate to provide strategic guidance, evaluate potential risks and ensure the adequacy of our cybersecurity measures. The committee regularly provides updates to senior leadership and the Audit Committee, as well as the full Board, which includes information regarding our cybersecurity program initiatives, program performance, and the reporting provided by third party service providers.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of this program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Among the key elements of our cybersecurity risk management program are the following: • Security Awareness and Training—We use an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are required to be completed annually by all employees. • Annual Risk Assessment—An annual risk assessment is conducted by a third party, which is designed to assess the effectiveness of the Company's security controls and to identify key risks. • Network Protection—Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections, in order to segment different sections of the business from each other, which strengthens key protection capabilities. • Identity and Access Management—We have implemented user authentication controls on the Company's systems, devices, data and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to systems and networks. • Penetration Testing—We have partnered with a third-party penetration testing company to help identify new vulnerabilities and continuously improve the security posture of the Company through annual testing. • Endpoint Detection and Response ("EDR")—EDR is an integrated, layered approach to endpoint protection that uses continuous monitoring and data analytics. We have partnered with a third-party security operations center, to provide critical support in monitoring, identifying and assessing cyber threats such as malware, ransomware, breaches, and denial of service attacks. • Security Incident Management—In the event of a cybersecurity incident, we have established an incident response plan, which outlines clear protocols for incident detection, containment, investigation, and resolution, aiming to minimize the impact on our operations, customers, and stakeholders.


text: Our Director of Enterprise Applications leads a dedicated management committee responsible for overseeing cybersecurity matters. The Information Security committee contributes decades of experience in technology, cybersecurity, architecture, and incident response in both military and private sector with certifications including Certified Information Systems Security Professional ("CISSP"), Certified Ethical Hacker ("CEH"), CompTIA Secure Infrastructure Specialist ("CSIS"), and degrees in cybersecurity, data science, and computer science. Collectively, this team has served in various large, publicly traded companies, implementing and managing robust IT and cybersecurity programs, developing tools, and safeguarding internal networks, business applications, customer-facing applications, and payment systems. This committee consists of members with diverse expertise, including information technology, legal, risk management and finance, who collaborate to provide strategic guidance, evaluate potential risks and ensure the adequacy of our cybersecurity measures. The committee regularly provides updates to senior leadership and the Audit Committee, as well as the full Board, which includes information regarding our cybersecurity program initiatives, program performance, and the reporting provided by third-party service providers.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology ("NIST") Cybersecurity framework to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. We also have a notification process for real-time escalation of material cyber incidents by members of our internal cybersecurity team to senior management, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and/or General Counsel, and the Board of Directors, in each case as appropriate.

companyName: BARNES GROUP INC


text: As part of our risk management program, we periodically conduct penetration testing through an independent third-party assessor, as well as internal user training and tabletop exercises. We also conduct self-assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST standards and industry best practices. In addition, we maintain processes governing interconnections with third-party systems and annually review critical vendors' cybersecurity positions for potential risks. This process includes review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), and direct interaction with key vendors to assess and address risks.


text: We have not experienced a cybersecurity threat, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: Cybersecurity Governance Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Director of Cybersecurity who has over 25 years' experience as an IT professional engaged in network architecture and cybersecurity, and is led by our Vice President, IT, a CPA with 10 years' experience leading IT, who reports to our Senior Vice President, Chief Financial Officer. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. As part of this process, the Board of Directors, through the Audit Committee, oversees the data protection and cybersecurity program, which includes reviewing management's risk assessments and the steps management has taken to monitor or mitigate our cybersecurity risk exposure. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape. For more information about the cybersecurity risks we face, see "Risks Related to Information Technology, Cybersecurity and Data Privacy" in Part I - Item 1A - Risk Factors.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards, and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, periodic employee awareness updates, engaging experts and third-party monitoring and detection tools.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: We employ third-party information technology ("IT") consultants to manage our information technology environment and help manage and assess cybersecurity risks.


text: Our IT Steering Committee, comprised of our Chief Executive Officer, our Chief Financial Officer, our General Counsel, and an IT consultant, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over our third-party IT consultants, monitoring systems and employee engagement. Our senior management team is responsible for reporting any identified cybersecurity risks to the Audit Committee of our Board of Directors.


text: The Audit Committee of our Board of Directors meets periodically with management to review the Company's overall policies with respect to risk assessment and risk management, including a review the systems and processes implemented by management to identify, assess, manage, and mitigate cybersecurity risks. Our senior management is responsible for the day-to-day supervision of the material risks we may face.


text: Our risks from cybersecurity threats have not affected or are reasonably not likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy BD's cybersecurity risk management program is focused on maintaining the confidentiality, integrity and availability of BD products, manufacturing and distribution operational technology ("OT"), enterprise IT and BD data. We incorporate cybersecurity risk management into our systems and processes, which we strive to align with multiple industry-leading cybersecurity standards, including the Joint Security Plan issued by the Health Sector Coordinating Council for BD products and guidelines issued by the National Institute of Standards and Technology (NIST) for our manufacturing and distribution OT and enterprise IT.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Our commitment to cybersecurity includes a total life cycle approach to protecting BD products, manufacturing and distribution OT, enterprise IT and BD data. Using various tools and techniques, we proactively monitor for suspicious activity and perform risk assessments (including independent third-party risk assessments), penetration testing and vulnerability scanning to identify potential threats and vulnerabilities. We also collaborate with government and industry leaders to gather and share cybersecurity threat intelligence. We provide mandatory annual cybersecurity awareness training for our 70,000+ associates, and we send phishing simulation emails monthly to all associates who use a BD email address and an assigned computing device. We also use tools to monitor unintentional sharing of personal, confidential and proprietary information. Our cybersecurity risk management program includes a documented incident response and critical incident management plan to identify, assess and manage the potential impact of cybersecurity threats or vulnerabilities and prioritize risk mitigation and/or remediation measures to safeguard BD products, manufacturing and distribution OT, enterprise IT and BD data.


text: We strive to align BD Information Security policies and procedures with industry best practices, including the NIST Cybersecurity Framework, International Organization for Standardization ("ISO")/International Electrotechnical Commission (IEC) 27001:2022 standards for information security, Underwriters Laboratories ("UL") 2900-1 Cybersecurity Standard for Medical Devices, and U.S. Food and Drug Administration's pre-market and post-market guidance for cybersecurity in medical devices. In 2022, BD achieved ISO/IEC 27001:2022 certification at the enterprise level, demonstrating that BD's Information Security Management System (ISMS) conforms to internationally recognized cybersecurity standards. In July 2024, BD engaged a third-party auditor to complete its second enterprise-level annual surveillance audit for ISO 27001, which determined that BD continues to meet these rigorous standards. These policies and procedures establish processes for handling data, assets, systems and other technology resources to help protect BD products, manufacturing and distribution OT, enterprise IT and BD data.


text: We also incorporate cybersecurity risk management into our Enterprise Risk Management ("ERM") program. Through our ERM program, we identify, assess and manage a broad range of risks across our businesses, regions and functions, and we align our risk management efforts with our corporate strategy. Our enterprise IT, manufacturing and distribution OT, third-party and product cybersecurity risks are each assessed as part of our ERM program. As part of our cybersecurity risk management program, we engage a range of third-party experts each year, including advisors, consultants and auditors, to evaluate and enhance our program through security attestations and certifications, maturity assessments and security testing. We also engage third parties for staff augmentation to strengthen our cybersecurity program through additional dedicated resources. In addition, we actively engage with intelligence agencies, law enforcement, and advocacy and industry groups.


text: We also identify, assess and manage risks associated with our use of third-party service providers and maintain a third-party risk management program that monitors third-party cybersecurity risk throughout the procurement lifecycle—from planning and sourcing through relationship conclusion. This program includes supplier cybersecurity vetting at the time of engagement, cybersecurity risk assessments and cybersecurity vulnerability monitoring. Our third-party risk management program is aligned with NIST and ISO/IEC frameworks and is focused on continuous improvement through intelligence sharing with industry groups.


text: There can be no assurance that such measures will be sufficient to prevent, mitigate or remediate cybersecurity incidents or breaches. Although we have experienced cyberattacks as discussed in "Item 1A, Risk Factors" above, based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect BD. Despite our efforts in implementing and maintaining our cybersecurity risk management program, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or breach in the future that may materially affect us. For further discussion of how our business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats, see "Item 1A, Risk Factors."


text: The Board and its committees provide oversight of our ERM program, including our cybersecurity risk management program and the protection and resilience of BD products, manufacturing and distribution OT, enterprise IT and BD data. In addition, our management periodically conducts cybersecurity crisis simulations with the full Board to raise awareness of cybersecurity risks and enhance our incident preparedness. We also provide Board members the opportunity to take a cybersecurity training course through an external service provider. The Board delegates oversight of our cybersecurity risk management program to the Audit Committee and the Quality and Regulatory Committee (QRC). The Audit Committee regularly reviews our cybersecurity risk management program with respect to manufacturing and distribution OT and enterprise IT, and the QRC reviews our product cybersecurity program.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), whose organization is responsible for identifying, assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of experience leading information security, data risk management, application/system development and engineering teams at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our CISO holds Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Certified Information Privacy Professional ("CIPP") and Security+ certifications and contributes to healthcare industry working groups, most recently serving as chair of the Health Information Sharing and Analysis Center (the "HISAC") Information Security Risk Management Working Group. Our CISO reports to our Chief Information Officer (CIO), who has overall responsibility for the cybersecurity risk management program and organization. Our CIO has more than 25 years of experience in information technology, business transformation, cybersecurity and technology solutions, including leadership roles at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our Vice President, Research and Development, Product Security ("VP of Product Security") also supports our cybersecurity risk management program by leading a team of product security professionals focused on implementing security by design, security in use and product end of life strategies across our portfolio of software-based products. Our VP of Product Security has more than 15 years of experience in the medical device industry, including at another publicly traded company managing product security. Our VP of Product Security has received training from the SANS Institute and contributes to healthcare industry groups such as the Health Sector Coordinating Counsel – Joint Cybersecurity Working Group.


text: Our CISO is supported by and is a member of our Cybersecurity Strategy and Risk Committee ("CSRC"), which is a management-level governance body for oversight of all of our cybersecurity risk. Our VP of Product Security is also a member of the CSRC. On a quarterly basis, our CSRC receives information from our CISO regarding BD's enterprise IT, manufacturing and distribution OT and product security programs, including the Company's strategy and progress on key initiatives. We also have an executive-level Enterprise Risk Committee (ERC) that oversees our ERM program and aims to create an enterprise-wide culture that promotes open discussion regarding risk and opportunities and integrates effective risk management into our goals and objectives. As part of integrating cybersecurity risk management into our ERM program, our ERC receives updates from our CIO and CISO on BD's cybersecurity risk management strategy and program on a regular basis. In addition to our CSRC and our ERC, we have established processes providing for the escalation of certain cybersecurity incidents and breaches. We maintain a global response plan that sets forth a detailed incident management and reporting protocol designed to respond to cybersecurity incidents and breaches appropriately and efficiently. Our operational team is responsible for communicating the impact and status of certain cybersecurity incidents and breaches to senior management, including the CISO, based on its assessment of the significance of the cybersecurity incident or breach. We also have a committee consisting of senior members of our management, including our CIO and CISO, to evaluate cybersecurity incidents and breaches reported to the committee by our CISO on an ad-hoc basis for potential material impacts on BD, including its financial condition and results of operations, and assess BD's public disclosure obligations. The CIO, CISO and other members of the committees are informed about the status, effectiveness and risks associated with our cybersecurity risk management program through their management of and participation in the cybersecurity risk management processes, policies and operations described above.


text: Our CIO and CISO provide updates to the Audit Committee, and our VP of Product Security provides updates to the QRC, multiple times per year regarding BD's cybersecurity risk management program, including the results of third-party assessments, progress towards cybersecurity goals and objectives, product cybersecurity matters, third-party risk management, regulatory compliance and other topics as needed. We also have processes by which certain cybersecurity incidents and breaches are escalated and reported to the Board of Directors or a Board committee, as appropriate, based on our management's assessment of risk.


text: Risk Management and Strategy BD's cybersecurity risk management program is focused on maintaining the confidentiality, integrity and availability of BD products, manufacturing and distribution operational technology ("OT"), enterprise IT and BD data. We incorporate cybersecurity risk management into our systems and processes through a comprehensive program guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0.


text: Our commitment to cybersecurity includes a total life cycle approach to protecting BD products, manufacturing and distribution OT, enterprise IT and BD data. Using various tools and techniques, we proactively monitor for suspicious activity and perform risk assessments, penetration testing and vulnerability scanning to identify potential threats and vulnerabilities. We also engage independent third parties to conduct cybersecurity assessments and attestations, and we collaborate with government and industry leaders, including industry working groups, to gather and share cybersecurity threat intelligence. We provide mandatory quarterly cybersecurity awareness training tailored to associates' and contractors' role-based responsibilities, and we send phishing simulation emails monthly to all users with a BD email address and an assigned computing device. Where permitted by law, we also use tools to monitor the sharing of personal, confidential and proprietary information to detect intentional or unintentional exfiltration from BD systems. Our cybersecurity risk management program includes a documented incident response and critical incident management plan to identify, assess and manage the potential impact of cybersecurity threats or vulnerabilities and prioritize risk mitigation and/or remediation measures to safeguard BD products, manufacturing and distribution OT, enterprise IT and BD data, including data of our customers.


text: We strive to align BD Information Security policies and procedures with industry best practices, including the NIST Cybersecurity Framework 2.0, International Organization for Standardization ("ISO")/International Electrotechnical Commission (IEC) 27001:2022 standards for information security, Underwriters Laboratories ("UL") 2900-1 Cybersecurity Standard for Medical Devices, and U.S. Food and Drug Administration's pre-market and post-market guidance for cybersecurity in medical devices as required by law under Section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act). The Healthcare Sector Coordinating Council (HSCC) Joint Security Plan (JSP) 2.0 is a recognized industry standard that informs how we manage the security of our products. These policies and procedures establish processes for handling data, assets, systems and other technology resources to help protect BD products, manufacturing and distribution OT, enterprise IT and BD data. In 2022, BD achieved ISO/IEC 27001:2022 certification at the enterprise level, demonstrating that BD's Information Security Management System (ISMS) conforms to internationally recognized cybersecurity standards. In 2025, BD engaged a third-party auditor to complete its third enterprise-level annual surveillance audit for ISO 27001, which determined that BD continues to meet these rigorous standards.


text: We also identify, assess and manage risks associated with our use of third-party service providers and maintain a third-party risk management program that monitors third-party cybersecurity risk throughout the procurement lifecycle—from planning and sourcing through relationship conclusion. This program includes supplier cybersecurity vetting at onboarding, and cybersecurity risk assessments, remediation, and cyber vulnerability monitoring while in-use, and deeper dive cyber risk assessments and security compliance monitoring is in place for our highest-risk suppliers. Our third-party risk management program is assessed for maturity by an independent third party and is aligned with NIST and ISO/IEC frameworks. We remain focused on continuous improvement through intelligence sharing with industry groups.


text: There can be no assurance that such measures will be sufficient to prevent, mitigate or remediate cybersecurity incidents or breaches. Although we have experienced cyberattacks as discussed in "Item 1A, Risk Factors" above, based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BD. Despite our efforts in implementing and maintaining our cybersecurity risk management program, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or breach in the future that may materially affect us. For further discussion of how our business, results of operations, financial condition and cash flows could be materially adversely affected by risks from cybersecurity threats, see "Item 1A, Risk Factors."


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), whose organization is responsible for identifying, assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of experience leading information security, data risk management, application/system development and engineering teams at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our CISO holds Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Certified Information Privacy Professional ("CIPP") and Security+ certifications and contributes to healthcare industry working groups. Our CISO reports to our Chief Information Officer (CIO), who has overall responsibility for the cybersecurity risk management program and organization. Our CIO has more than 25 years of experience in information technology, business transformation, cybersecurity and technology solutions, including leadership roles at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our Vice President, Research and Development, Product Security ("VP of Product Security") also supports our cybersecurity risk management program by leading a team of product security professionals focused on cybersecurity across the product lifecycle—including new product development, in-market products and end-of-life strategies—for our portfolio of software-based products. Our VP of Product Security has nearly 20 years of experience in the medical device industry, including at another publicly traded company managing product security, and has also received training from the SANS Institute.


text: The Board and its committees provide oversight of our ERM program, including our cybersecurity risk management program and the protection and resilience of BD products, manufacturing and distribution OT, enterprise IT and BD data. In addition, our management periodically conducts cybersecurity crisis simulations and shares outcomes with the full Board to raise awareness of cybersecurity risks and enhance our incident response preparedness. We also provide Board members the opportunity to take a cybersecurity training course through an external service provider. The Board delegates oversight of our cybersecurity risk management program to the Audit Committee and the Quality and Regulatory Committee (QRC). The Audit Committee regularly reviews our cybersecurity risk management program with respect to manufacturing and distribution OT and enterprise IT, and the QRC reviews our product cybersecurity program.


text: Our CISO is supported by and is a member of our Cybersecurity Strategy and Risk Committee ("CSRC"), which is a management-level governance body for oversight of all of our cybersecurity risk. Our VP of Product Security is also a member of the CSRC. On a quarterly basis, our CSRC receives information from our CISO regarding our enterprise IT, manufacturing and distribution OT and product security programs, including the Company's strategy and progress on key initiatives. We also have an executive-level Enterprise Risk Committee (ERC) that oversees our ERM program and aims to create an enterprise-wide culture that promotes open discussion regarding risk and opportunities and integrates effective risk management into our goals and objectives. As part of integrating cybersecurity risk management into our ERM program, our ERC receives updates from our CIO and CISO on BD's cybersecurity risk management strategy and program on a regular basis. In addition to our CSRC and our ERC, we have established processes providing for the escalation of certain cybersecurity incidents and breaches. We maintain a global response plan that sets forth a detailed incident management and reporting protocol designed to respond to cybersecurity incidents and breaches appropriately and efficiently. Our operational team is responsible for communicating the impact and status of certain cybersecurity incidents and breaches to senior management, including the CISO, based on its assessment of the significance of the cybersecurity incident or breach. We also have a committee consisting of senior members of our management, including our CIO and Chief Risk Officer, to evaluate cybersecurity incidents and breaches reported to the committee by our CISO on an ad-hoc basis for potential material impacts on our Company, including its financial condition, results of operations and cash flows, and to have a sub-committee of our disclosure committee assess our public disclosure obligations. The CIO, CISO and other members of the committees are informed about the status, effectiveness and risks associated with our cybersecurity risk management program through their management of and participation in the cybersecurity risk management processes, policies and operations described above.


text: Our CIO and CISO provide updates to the Audit Committee, and our VP of Product Security provides updates to the QRC, multiple times per year regarding our cybersecurity risk management program, including the results of third-party assessments, progress toward cybersecurity goals and objectives, product cybersecurity matters, third-party risk management, regulatory compliance and other topics as needed. We also have processes by which certain cybersecurity incidents and breaches are escalated and reported to the Board of Directors or a Board committee, as appropriate, based on our management's assessment of risk.


text: Cybersecurity Strategy and Risk Management Program The Company has a documented information security program (the Program) to identify, assess, monitor and manage potential cybersecurity threats and incidents. The Program is designed to protect the confidentiality, integrity and availability of our information systems and assets that store, process, or transmit information. The Program is modeled on the global standard for risk assessment, International Organization for Standardization 27001, and is guided by the six domains of cybersecurity established by the National Institute of Standards and Technology Cybersecurity Framework (i.e., govern, identify, protect, detect, respond, and recovery). The Program seeks to adhere to applicable U.S. and international laws and regulations, including New York State's cybersecurity regulation applicable to financial services institutions authorized by the New York State Department of Financial Services.

companyName: BERKLEY W R CORP

ticker: WRB


text: The Program's security and risk policies and standards, implemented by either the Company or third party assessors or consultants, include: –information security management tools, such as firewalls, intrusion prevention and detection systems, anti-malware functionality, and access privilege controls; –vulnerability management, including penetration and control testing and vulnerability scans of information systems; –incident monitoring, breach notification and escalation, including disaster recovery and incident response plans and resources; –risk based assessment of third party service providers; and –annual cybersecurity awareness training for employees and contractors.


text: The Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – Risks Relating to Our Business – "If our information technology, telecommunications or other computer systems become unavailable or unreliable, our ability to conduct our business could be negatively or severely impacted" and "Failure to maintain the security of information technology systems and confidential data may expose us to liability."


text: Board Oversight, Governance and Risk Management The entire Board of Directors has oversight of risks from cybersecurity threats and receives periodic updates on such risks from the Company's management, including from the Company's President and CEO and its Vice President, Chief Information Security Officer (CISO).


text: Our CISO is principally responsible for assessing and managing all aspects of the Program, including the Company's Regional Information Security Officers (RISOs), third-party consultants, development of industry trends and control testing and tracking by risk level. Our CISO meets periodically with senior executives, including the Company's President and Chief Executive Officer, to discuss the Company's cybersecurity strategy, and its monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. Regular reporting on the Program is also provided to the Company's Enterprise Risk Management Committee, which is comprised of the President and CEO, Senior Vice President – Enterprise Risk Management, Executive Vice President – Investments, Executive Vice President – Chief Financial Officer, Executive Vice President – Secretary, and the Of Counsel and Assistant Secretary. Collectively, the CISO and RISOs, along with their teams, in collaboration with the technology and business owners, implement the Program. Legal, Compliance, and Internal Audit functions also assess the Program's adherence to regulatory requirements and internal controls.


text: In the event of a potentially material cybersecurity incident, the Company's incident response plans establish escalation protocols for relevant IT leaders and functional leaders within Enterprise Risk Management, Legal, Compliance and Internal Audit to engage management as appropriate.


text: Our CISO has over 25 years of information security experience and is licensed as a Certified Information Systems Security Professional.


text: Cybersecurity Risk Management and Strategy The Company has a documented information security program (the "Program"), which is integrated into its overall risk management processes, to identify, assess, monitor and manage potential cybersecurity threats and incidents. The Program is designed to protect the confidentiality, integrity and availability of our information systems and assets that store, process, or transmit information. The Program is modeled on the global standard for risk assessment, International Organization for Standardization 27001, and is guided by the six domains of cybersecurity established by the National Institute of Standards and Technology Cybersecurity Framework (i.e., govern, identify, protect, detect, respond, and recovery). The Program seeks to adhere to applicable U.S. and international laws and regulations, including New York State's cybersecurity regulation applicable to financial services institutions authorized by the New York State Department of Financial Services.


text: The Company engages third party consultants with respect to cybersecurity, including to conduct vulnerability assessments and penetration testing of its information technology systems. The Company has established a regular vendor risk management process to evaluate and address potential risks associated with the use of such third parties.


text: The Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see "Risk Factors – Risks Relating to Our Business – If our information technology, telecommunications or other computer systems become unavailable or unreliable, our ability to conduct our business could be negatively or severely impacted" and "Failure to maintain the security of information technology systems and confidential data may expose us to liability"; and "Use of artificial intelligence technologies, by us or third-parties on whom we rely, could expose us to technological, security, legal, and other risks."


text: Board Oversight, Governance and Risk Management The entire Board of Directors has oversight of risks from cybersecurity threats and receives periodic updates on such risks from the Company's management, including from the Company's President and CEO and its Senior Vice President - Chief Information Security Officer (CISO).


text: Our CISO, who has over 25 years of information security experience and is licensed as a Certified Information Systems Security Professional, is principally responsible for assessing and managing all aspects of the Program, including the Company's Regional Information Security Officers (RISOs), third-party consultants, development of industry trends and control testing and tracking by risk level. Our CISO meets periodically with senior executives, including the Company's President and CEO, to discuss the Company's cybersecurity strategy, and its monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. Regular reporting on the Program is also provided to the Company's Enterprise Risk Management Committee, which is comprised of the President and CEO, Senior Vice President – Enterprise Risk Management, Executive Vice President – Investments, Executive Vice President – Chief Financial Officer, and Executive Vice President – Secretary. Collectively, the CISO and RISOs, along with their teams, in collaboration with the technology and business owners, implement the Program. Legal, Compliance, and Internal Audit functions also assess the Program's adherence to regulatory requirements and internal controls.


text: In the event of a potentially material cybersecurity incident, the Company's incident response plans establish escalation protocols for relevant IT leaders and functional leaders within Legal, Compliance and Internal Audit to engage management as appropriate.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 and Center for Internet Security, Critical Security Controls (CIS Controls). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information about our cybersecurity related risks, see Part 1, Item 1A, Risk Factors under the risks titled "Breaches of our information systems could have a material adverse effect on our business and results of operations" and "If our information technology systems are disrupted, or if we fail to successfully implement, manage and integrate our information technology and reporting systems, our business, results of operations and financial condition could be harmed."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Legal and Regulatory Compliance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations or reports on cybersecurity topics from our SVP Global Technology & Systems, who is our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including, our Chief Information Security Officer, Chief Privacy Officer, General Counsel, Director of Information Security & IT Compliance, Corporate Treasurer, and Internal Audit Senior Director, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes a wealth of expertise in navigating the complex landscape of cybersecurity, with a robust background in cyber risk management and incident response. With a collective experience that spans several decades, our team has successfully addressed and mitigated diverse cyber threats, ranging from sophisticated attacks to emerging vulnerabilities. Members of our management team hold industry-recognized certifications, including but not limited to CISSP, CISA, and CEH, underscoring their commitment to continuous professional development and adherence to the highest standards in the field.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process to oversee critical service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past fiscal year, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information about our cybersecurity related risks, see Part I, Item 1A, Risk Factors under the risks titled "Breaches of our information systems could have a material adverse effect on our business and results of operations" and "If our information technology systems are disrupted, or if we fail to successfully implement, manage and integrate our information technology and reporting systems, our business, results of operations and financial condition could be harmed."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Legal and Regulatory Compliance Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations or reports on cybersecurity topics from our SVP Global Technology & Systems, who is our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.

companyName: BOEING CO

ticker: BA


text: We maintain security programs that include physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and timely and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems as well as our aerospace products and services, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practice into our Enterprise Risk Management program and our Compliance Risk Management program, both of which are overseen by our Board of Directors and provide central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. Risks from cybersecurity threats to our products and services are also overseen by our Board of Directors. In addition, we periodically engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents.


text: As part of our cybersecurity risk management process, we conduct "tabletop" exercises during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness. These exercises are conducted at both the technical level and senior management level, which has included participation by a member of our Board of Directors. In addition, all employees are required to pass a mandatory cybersecurity training course on an annual basis and receive monthly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.


text: We have established a cybersecurity supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the products or services we procure from such suppliers. We generally require our suppliers to adopt security-control principles based on industry-recognized standards.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to Cybersecurity and Business Disruptions" in "Risk Factors" on page 14 of this Form 10-K.


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Audit Committee and the Aerospace Safety Committee, and each committee reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO) and our Chief Security Officer (CSO) provide presentations to the Audit Committee on cybersecurity risks at each of its bimonthly meetings. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. In addition, the Audit Committee has designated one of its members with expertise in cyber risk management to meet regularly with management and review our cybersecurity strategy and key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. The Aerospace Safety Committee provides oversight of the risks from cybersecurity threats related to our aerospace products and services. The Aerospace Safety Committee receives regular updates and reports from senior management, including the Chief Engineer, the Chief Aerospace Safety Officer, and the Chief Product Security Engineer, who provide briefings on significant cybersecurity threats or incidents that may pose a risk to the safe operation of our aerospace products. Both committees brief the full Board on cybersecurity matters discussed during committee meetings, and the CIO provides annual briefings to the Board on information technology and data analytics related matters, including cybersecurity.


text: At the management level, we have established a Global Security Governance Council (the Council) to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Council is responsible for developing and coordinating enterprise cybersecurity policy and strategy, and for providing guidance to key management and oversight bodies.


text: Richard Puckett, as our CSO, serves as the chair of the Council. He is responsible for overseeing a unified security program that provides cybersecurity, fire and protection operations, physical security, insider threat, and classified security. Mr. Puckett has nearly 30 years of experience in the cybersecurity industry, including, prior to joining Boeing in 2022, as Chief Information Security Officer of SAP SE and Thomson Reuters Corporation, Vice President, Product and Commercial Security of General Electric, Inc., and Senior Security Architect at Cisco Systems, Inc. He reports directly to the CIO and meets regularly with other members of senior management and the Audit Committee.


text: The Council also includes, among other senior executives, our Chief Engineer, Chief Information Officer, Chief Aerospace Safety Officer and Chief Product Security Engineer, who each have several decades of business and senior leadership experience managing risks in their respective fields, collectively covering all aspects of cybersecurity, data and analytics, product security engineering, enterprise engineering, safety and the technical integrity of our products and services.


text: The Council meets monthly and updates key members of the Company's Executive Council on progress towards specific cybersecurity objectives. A strong partnership exists between Information Technology, Enterprise Security, Corporate Audit, and Legal so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: As part of our cybersecurity risk management process, we conduct "tabletop" exercises during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness. In addition, all employees are required to complete a mandatory cybersecurity training course on an annual basis and receive monthly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to Technology, Security and Business Disruptions" in "Risk Factors" on pages 14 - 15 of this Form 10-K.


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Audit Committee and the Aerospace Safety Committee, and each committee reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our Chief Information Digital Officer and Senior Vice President, Information Technology & Data Analytics (CIDO) and our Chief Security Officer (CSO) provide presentations to the Audit Committee on cybersecurity risks at each of its bimonthly meetings. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. In addition, the Audit Committee has designated one of its members with expertise in cyber risk management to meet regularly with management and review our cybersecurity strategy and key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. The Aerospace Safety Committee provides oversight of the risks from cybersecurity threats related to our aerospace products and services. The Aerospace Safety Committee receives regular updates and reports from senior management, including the Chief Engineer, the Chief Aerospace Safety Officer, and the Chief Product Security Engineer, who provide briefings on significant cybersecurity threats or incidents that may pose a risk to the safe operation of our aerospace products. Both committees brief the full Board on cybersecurity matters discussed during committee meetings, and the CIDO provides annual briefings to the Board on information technology and data analytics related matters, including cybersecurity.


text: Trent Cox, Vice President of Product and Business Operations, is serving as our interim CSO. In that role, he chairs the Council and is responsible for overseeing a unified security program that provides cybersecurity, fire and protection operations, physical security, insider threat, and classified security. Mr. Cox has over 25 years of experience in the aerospace and defense industry, including, prior to joining Boeing in 2024, Chief Information Officer of Raytheon UK, Deputy CIO and Executive Director of Collins Aerospace and Raytheon Intelligence and Space, and Executive Director for Program Execution for the Raytheon Missile Systems businesses. He reports directly to the CIDO and meets regularly with other members of senior management and the Audit Committee.


text: The Council also includes, among other senior executives, our CIDO, Chief Engineer, Chief Information Officer, Chief Aerospace Safety Officer and Chief Product Security Engineer, who each have several decades of business and senior leadership experience managing risks in their respective fields, collectively covering all aspects of cybersecurity, data and analytics, product security engineering, enterprise engineering, safety and the technical integrity of our products and services.


text: The Council meets monthly and updates key members of the Company's Executive Council on progress towards specific cybersecurity objectives. A strong partnership exists between Information Technology, Enterprise Security, Corporate Audit, and Law so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Risk Management and Strategy The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board. The Company employs robust cybersecurity and data privacy programs that are largely aligned to, among others, the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify and manage material risks from cybersecurity threats.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We are constantly evolving our cyber defenses to minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data. We are particularly focused on addressing emerging cybersecurity risks, including human risk, as phishing attacks remain one of the most common causes of data breaches; third-party supply chain risks, as threat actors continue to target supply chains to compromise a greater number of victims; and geopolitical risk, as tensions and conflicts around the world are often accompanied by an increase in sabotage, espionage and cyber attacks. As threat actors frequently target employees to gain access to information and systems, we have a comprehensive global human risk management program that educates our workforce on threats they face as a first line of defense, and includes elements addressing phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. Our employees are exposed to data-driven cybersecurity awareness campaigns and training in order to keep pace with industry standards, evolving challenges and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the organization. Additionally, we employ a multi-layered approach in our application of cybersecurity technologies to help safeguard our systems, networks, and data from potential cybersecurity threats. For companies that we acquire, our integration plans include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.


text: To support our preparedness, we have a cybersecurity incident response plan ("CIRP") that we regularly update as business needs and the security landscapes change. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform periodic tabletop exercises annually to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: We engage with third parties to separately conduct cyber assessments on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics are utilized to identify potential vulnerabilities. We recognize that third parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To manage third-party risk, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers. As noted, we also conduct tabletop exercises to identify gaps in our supply chain resilience so we can implement improvements.


text: We maintain relationships with law enforcement, government agencies, forensic investigators, and legal counsel to inform our cybersecurity and data privacy programs.


text: As of December 31, 2023, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We face risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity incidents and data leakage."


text: The Company's cybersecurity and data privacy programs are implemented and overseen by the Company's Chief Information Security Officer ("CISO"), the Executive Vice President, Chief Digital and Technology Officer, and senior management. The information security team responsible for managing and implementing the Company's cybersecurity and data privacy programs has many years of valuable business experience managing risks from cybersecurity threats and data privacy breaches and developing and implementing cybersecurity and data privacy policies and procedures.


text: Our Audit Committee, which consists solely of independent directors, oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management and oversees the Company's information security and data protection programs. In particular, the Audit Committee receives periodic updates from the CISO, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company's business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company's cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. After each such update, the Chair of the Audit Committee updates the full Board. The Board also receives similar cybersecurity updates directly from the CISO and other members of management at least annually, and as needed from time to time.


text: Risk Management and Strategy The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board. The Company employs robust cybersecurity and data privacy programs that are designed to assess, identify and manage material risks from cybersecurity threats. These programs are independently assessed every three years against the U.S. National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: We are constantly evolving our cyber defenses to minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data. We are particularly focused on addressing emerging cybersecurity risks, including human risk, as phishing attacks remain one of the most common causes of data breaches; third-party supply chain risks, as threat actors continue to target supply chains to compromise a greater number of victims; and geopolitical risk, as tensions and conflicts around the world are often accompanied by an increase in sabotage, espionage and cyber attacks. As threat actors frequently target employees to gain access to information and systems, we have a comprehensive global human risk management program that educates our workforce on threats they face as a first line of defense, and includes elements addressing phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. Our employees are exposed to data-driven cybersecurity awareness campaigns and annual training in order to keep pace with industry standards, evolving challenges and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the organization. In many regions, our employees receive a monthly snapshot of their cyber behaviors and are given a rating for their cyber vigilance. Additionally, we employ a multi-layered approach in our application of cybersecurity technologies to help safeguard our systems, networks, and data from potential cybersecurity threats. For companies that we acquire, our integration plans include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.


text: To support our preparedness, we have a cybersecurity incident response plan ("CIRP") that we regularly update as business needs and the security landscapes change. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform multiple tabletop exercises across various levels of the Company each year to test our incident response procedures, enhance our resiliency by seeking to ensure business continuity during potential extended digital outages, identify improvement opportunities and increase employee awareness and preparedness. These tabletop exercises focus on various aspects of cybersecurity events, including patient and employee impact, operational resilience and effectiveness and communication coordination.


text: We engage with third parties to separately conduct cyber assessments on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics are utilized to identify potential vulnerabilities. We recognize that third parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To manage third-party risk, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers. As noted, we also conduct tabletop exercises to identify improvement opportunities in our supply chain resilience.


text: While we and our third-party vendors are regularly subject to cybersecurity attacks and incidents, a s of December 31, 2024 and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company in the last three years. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We face risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity incidents and data leakage."


text: The Company's cybersecurity and data privacy programs are implemented and overseen by the Company's Chief Information Security Officer ("CISO"), the Executive Vice President, Chief Digital and Technology Officer, and senior management. The CISO reports to the Chief Digital & Technology Officer, who in turn reports to the CEO. Collectively, our CISO and senior management team have extensive experience in information security and information technology risk management, including cybersecurity. Our CISO has led our enterprise-wide cybersecurity risk management, strategy, policy, standards and processes since 2018, and t he information security team responsible for managing and implementing the Company's cybersecurity and data privacy programs has many years of valuable business experience effectively addressing cybersecurity risks and developing related robust policies and procedures.


text: Our Audit Committee, which consists solely of independent directors, oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management at least annually and oversees the Company's information security and data protection programs. In particular, the Audit Committee receives periodic updates from the CISO, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company's business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company's cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. After each such update, the Chair of the Audit Committee updates the full Board. The Board also receives similar cybersecurity updates directly from the CISO and other members of management at least annually, and as needed from time to time.


text: Cybersecurity Risk Management Strategy and Processes Our Chief Information Security Officer (CISO) leads our Global Information Security team, reports to the Chief Information Officer (CIO), and meets regularly with other members of senior management. Our CISO holds advanced degrees in Computer Science and Business Administration, in addition to relevant IT and cybersecurity certifications from organizations such as the EC Council, ISACA, and CSA. She has served in various IT roles for over 20 years, including leading the IT Security function.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Our Global Information Security Team is responsible for the information security strategy, policy, security engineering, operations, and cyber threat detection and response. Our Global Information Security Team, which includes a security operations center, seeks to protect the company against reasonably foreseeable cyber threats and risks. The cybersecurity team members have the qualifications and certifications for their roles. They also have relevant industry experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes globally. We also rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants that we engage.


text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are also continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.


text: In the event of an incident, we leverage a multi-layered set of plans that include, Endpoint Detection and Response software, Security Information and Event Management tools for detection, and a Cybersecurity Incident Response Plan and Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, reputational impacts on the Company to determine the materiality of the incident and the appropriate response..


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.


text: We rely on third party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, system, or business during the past reporting period. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.


text: Cybersecurity Governance The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee regularly reports on its activities and findings with respect to risks from cybersecurity threats to the full Board of Directors.


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee on a quarterly basis regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner, and report them to senior leadership, the Board of Directors, and appropriate regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM work is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.


text: Our Global Information Security team is responsible for the information security strategy, policy, security engineering, operations, and cyberthreat detection and response. Our Global Information Security team, which includes a security operations center, seeks to protect the company against reasonably foreseeable cyberthreats and risks. The cybersecurity team members have the qualifications and certifications required for their roles. In addition, they have relevant industry experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes globally. In order to stay ahead of potential threats and enhance our overall security posture, we rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants that we engage.


text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. We temper this architecture with a business-risk-based approach that ensures we protect our digital assets while aligning our security measures with our overall organizational goals and priorities. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.


text: In the event of an incident, we leverage a multi-layered set of plans that include Endpoint Detection and Response software, Security Information and Event Management tools for detection, a Cybersecurity Incident Response Plan, and a Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, and reputational impacts on the Company to determine the materiality of the incident and the appropriate response.


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third-party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability tests, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.


text: We rely on third-party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third-party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire, and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, systems, or business. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee quarterly regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner and report them to senior leadership, the Board of Directors, and regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision-making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM update is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.