text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's cybersecurity program is led by our CISO, who, effective October 1, 2024, reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.


text: The members of management who lead our Cybersecurity Program have extensive experience in technology, cybersecurity, and information security. Our CIO has over 35 years of relevant experience, including 25 years leading technology teams at multiple global financial services institutions, and is a Certified Information Security Manager and Registered Series 99 Operations Professional. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management, and is a Certified Information Systems Security Professional and Registered Series 99 Operations Professional. Both our CIO and CISO also participate in various financial services industry committees and cybersecurity advisory boards.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF

secItem: Item 1C


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") framework. As part of our ERM framework, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, firm data, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a third-party risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our third-party risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor our principal third parties and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third parties, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.


text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's Cybersecurity Program is led by our CISO, who reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.


text: Cybersecurity Risk Management and Strategy Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.


text: The Company's planned investments in cybersecurity include implementing advanced data loss prevention measures, encryption protocols, and continuous monitoring to safeguard sensitive information and mitigate the risk of unauthorized access or disclosure. As part of the Company's risk management strategy, it has secured comprehensive cyber insurance coverage. The Company regularly reviews and updates its cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks Governance


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior management, including our CISO, periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.


text: Our CISO has 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders to include Risk, Legal, Finance, IT, Operations, and Business line leads.


text: Cybersecurity Risk Management and Strategy Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management. T he company's enterprise information security program adheres to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and other relevant industry frameworks as necessary.


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.


text: The Company's planned investments in cybersecurity include implementing advanced data loss prevention measures, encryption protocols, and continuous monitoring to safeguard sensitive information and mitigate the risk of unauthorized access or disclosure. As part of the Company's risk management strategy, it has secured comprehensive cyber insurance coverage. The Company regularly reviews and updates its cyber insurance coverage to align with the evolving nature of c yber threats and industry standards.


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior manage ment periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.


text: Our CISO has more than 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders including Risk, Legal, Finance, IT, Operations, and Business line leads.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and threat actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See section "Risks Relation to our Operations".

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • an internal information security team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party information security and cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • ongoing cybersecurity training and phishing testing for our employees.


text: This information security program is a key part of our overall risk management system. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our Vice President – Information Security Officer. Our current Information Security Officer has over 15 years of experience, including prior work in the healthcare field, and is a Certified Information Systems Security Professional and CompTIA Security+ certified.


text: In addition, our board of directors, as a whole and through the Bank's Corporate Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives reports, at least quarterly, from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security related items and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, and through the use of technological tools and software and results from third party assessments.


text: Our Chief Security Officer and Chief Information Officer provide quarterly briefings to the Security Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Security Committee provides regular updates to the Board of Directors on such reports. In addition, our Chief Security Officer and our Chief Information Officer provide annual briefings to the Board of Directors on cybersecurity risks and activities.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks, such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement, or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: We evaluate cybersecurity incidents individually and in the aggregate to assess materiality. Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please see Item 1A. Risk Factors, "Risks Related to Our Business, Operations, and Industry—Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security-related items, and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, the use of technological tools and software, and results from third-party assessments.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: CINTAS CORP

ticker: CTAS


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over fifteen years of IT and cybersecurity leadership experience and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.


text: We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at technical and executive levels and incorporate external resources and advisors, as needed. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT Security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.


text: We face a number of cybersecurity risks in connection with our business. We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Although such risks and attacks have not materially affected us, including our business strategy, consolidated results of operations or consolidated financial condition, to date, our security programs and measures may not prevent all intrusions, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the information technology systems related risk factor in Item 1A: Risk Factors - Risks Relating to Business Strategy and Operations.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0), which organizes cybersecurity into six functions: govern, identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over twenty-five years of IT and cybersecurity experience, has served over fifteen years in various cybersecurity management roles, and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CISO is a part of, and is supported by, our IT security team, which includes other security leaders, security engineers, and security analysts. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.


text: We view cybersecurity as a shared responsibility. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills at technical and executive levels and incorporate external resources and advisors, as needed. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, the Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.


text: We regularly use both outsourced and in-house information security expertise to employ a variety of administrative, technical, and physical data safeguards designed to both deter and mitigate cybersecurity risks, including cyber incident response procedures, endpoint threat detection and response solutions, employee training, third-party risk reviews, penetration testing, technical control reviews, vulnerability assessments, and enterprise-wide risk assessments. These policies and procedures, which are based on the National Institute of Standards and Technology framework, align with international standards under ISO/IEC 27001 and are reviewed annually, including via an annual assessment of relevant IT SOX controls and Payment Card Industry Data Security Standard reviews performed both by external Qualified Security Assessors and authorized members of our internal information security team. Our third-party due diligence processes also include procedures for identifying cybersecurity threats associated with third-party service providers. Cybersecurity risks are also identified and evaluated through our enterprise risk management (ERM) processes, which are overseen by the Audit Committee of our Board of Directors. Through our ERM processes, key stakeholders across the business identify, assess, and manage risk, including material cybersecurity risks. These processes enable us to monitor and assess the evolving landscape of cybersecurity risks.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: Our information security program is administered under the supervision of our EVP, Chief Digital and Innovation Officer (CDIO) and Vice President (VP) of Platforms, Infrastructure and Cybersecurity, who share responsibility for assessing and managing the Company's cybersecurity risks. Both our CDIO and VP of Platforms, Infrastructure, and Cybersecurity have over 20 years of related experience, holding technical leadership roles at notable multinational organizations, across diverse industries.


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detention, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.


text: The Audit Committee of our Board of Directors oversees risks associated with information technology and cybersecurity. Cybersecurity risks and incidents identified through these processes are evaluated by our CDIO and VP of Platforms, Infrastructure and Cybersecurity. Our VP of Platforms, Infrastructure and Cybersecurity provides regular updates on a quarterly basis, and more frequently as required, on these matters to the Audit Committee of our Board of Directors. Such reports may include discussions on current control audits, risk assessments, proposed mitigation measures, and other key information technology and cyber initiatives.


text: Information about our material cybersecurity risks can be found in Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.


text: The Corporation has developed an information security program to assess, identify, and monitor cybersecurity risks. The Corporation regularly assesses cybersecurity risks arising from the operating environment and attempts to identify the likelihood and severity of the risk and the possible impact of the risk on the Corporation, its customers, and employees.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: The Corporation conducts periodic testing of software, hardware, defensive capabilities, and other information security systems utilizing both internal processes and third-party consultants. Testing procedures are supplemented by regular cyber threat exercises and employee training. Threat simulation exercises are used to develop and refine the Corporation's incident response plans and employees undergo cybersecurity awareness training on a regular basis.


text: The Corporation also addresses cyber risks posed by its relationships with third-party vendors. The Corporation assesses vendor risk as a part of its vendor management process, which requires a pre-acquisition diligence review, including the review of the vendor's information security policy for all vendors determined to be a "critical vendor". The vendor management process also requires a review of all critical vendors annually and all critical vendors are reported to the Board of Directors.


text: The Corporation's information security program is led by the Chief Technology Officer in conjunction with the Chief Risk Office and the Executive Enterprise Risk Management Committee. The Board Enterprise Risk Management Committee is responsible for oversight of the Corporation's cybersecurity and information security program and regularly reviews and evaluates information security and cybersecurity risks provided by management.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Corporation. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Corporation has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The Corporation is exposed to a variety of cybersecurity risks that could adversely affect our operations, reputation, and financial results. Cybersecurity incidents, including data breaches, denial of service attacks, malware, ransomware, phishing, and other intrusions, could compromise the confidentiality, integrity, or availability of sensitive information and disrupt our systems. Such incidents could result in unauthorized access to customer or employee information, financial losses, regulatory penalties, and litigation. Our dependence on technology to deliver banking services and manage our operations increases the potential impact of cybersecurity risks.


text: The Corporation has developed an information security program to protect the confidentiality, integrity, and availability of our data, information systems, and digital assets from disruption, breach, or theft. As a financial institution we store and protect nonpublic data related to customers, employees, and business operations. Securing this data at all times is critical to our business. The Corporation's information security program was developed to assess, identify, and monitor cybersecurity risks.


text: The cybersecurity framework utilized by the Corporation is based on recommendations from the National Institute of Standards and Technology (NIST), ISO/IEC 27001 & 27002, Federal Financial Institutions Examination Council (FFIEC), industry standards and best practices, and other applicable regulatory guidance. We maintain robust cybersecurity policies and procedures identify risks and mitigate where feasible. Policies and procedures address; vendor management and third-party risk, incident response, disaster recovery and business continuity, electronic banking, data classification and retention. The Corporation's information security program is led by the Chief Technology Officer (CTO) in conjunction with the Chief Risk Officer (CRO) having over 50 years of combined experience in financial services risk management, and information security. Their experience includes incident response, vendor management, disaster recovery and business continuity, breach mitigation as well as relevant professional certification. Along with the CTO and CRO, the Executive Enterprise Risk Management Committee (EERM)and the Board Enterprise Risk Management Committee (BERM) are responsible for oversight of the Corporation's cybersecurity and information security program and regularly reviews and evaluates information security and cybersecurity risks provided by management. Key risk indicators (KRIs) are regularly reported to the EERM Committee and BERM for review on a quarterly basis or as needed. The CRO provides updates to the Board of Directors multiple times a year and as needed. This includes facilitating training for the Board on cybersecurity risks and threats. The Board of Directors is also responsible for reviewing and approval policies critical to the information security program annually.


text: All employees participate in annual cybersecurity training courses conducted by the Training department with oversight from the CTO. Additional training exercises are administered throughout the year to increase cybersecurity awareness and address relevant risks.


text: The Corporation conducts periodic testing of software, hardware, defensive capabilities, and other information security systems utilizing both internal processes and third-party consultants. Testing procedures are supplemented by regular cyber threat exercises and employee training. Threat simulation exercises are used to develop and refine the Corporation's incident response plans. A defense-in-depth strategy is utilized to provide various layers of defense to identify and protect against risks to the Corporations network and computer systems. We utilize industry standards such as but not limited to; advanced firewall, content filtering, email gateway protections, endpoint detection and response software, and data loss prevention software.


text: Access to systems is granted on an as needed basis as it relates to the job functions of an individual. All access changes must be requested based on job function and approved by the appropriate departments. Changes are reviewed monthly, and all access rights to all significant systems are reviewed and verified annually.


text: An incident response plan is in place to ensure swift and effective action in the event of a cybersecurity incident. The plan defines the Incident Response Team (IRT) which includes representatives from executive management, critical business lines, and communications. The plan outlines responsibilities of the IRT to meet in the event of an incident and ensure proper containment, investigation and forensic analysis, recovery procedures, and notifications are made within the parameters of all applicable laws and regulations. The IRT participate in testing of the plan at least annually through simulated cyberattack exercises. The Board of Directors reviews and approves the plan annually.


text: As a shell company with no current business or operations, our accounting systems are included in the accounting systems of our parent company, Vector Group Ltd. (Commission File No. 1- 5759). Consequently, our management team relies on the cybersecurity processes that our parent company has established to oversee and identify material risks from cybersecurity threats. Therefore, none of the committees are responsible for the oversight of risks from cybersecurity threats. See "Item 1C. Cybersecurity" of Vector Group Ltd.'s Form 10-K for the year ended December 31, 2023 for a discussion of its comprehensive cybersecurity approach.

companyName: MULTI SOLUTIONS II, INC


text: Risk Management and Strategy The Company's information security program encompasses the security policies and procedures in place throughout the enterprise network to address compliance, transaction, reputation, and strategic risks. Our Information Security Officer is primarily responsible for this managing the information security program that includes identifying, assessing, and mitigating cyber threats. Our Information Security Officer reports directly to the Chief Information Officer.

companyName: CITY HOLDING CO

ticker: CHCO


text: Our objective for managing cybersecurity as part of the information security program is to ensure adequate procedures and proper controls are in place in order to provide an objective system for recording and aggregating information, supporting the institution's strategic goals and objectives, and protecting the security and confidentiality of the institution's customers and business activities. Our information security program leverages guidance from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The information security program is periodically reviewed by the board of directors and updated by the Information Security Officer to adapt to potential new threats and conditions.


text: The Company employs a combination of patch management, network security, malicious code prevention, and user awareness and training to assist with preventing cybersecurity incidents. Users are made aware of policies and procedures regarding appropriate use of networks, systems, and applications. Additionally, employees are trained in handling sensitive data and made aware of specific requirements when handling client data. Periodic review and assessment of network infrastructure is completed. The Company, in certain instances, may rely on vendors, third-party support, or other outsourcing opportunities. Before introducing a new product or service, the internal controls and competence of a vendor, maintenance and upkeep of a third-party provider's systems, and financial condition of the third-party vendor are evaluated. Internal and external auditors and independent external partners are engaged and periodically review the Company's processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Policy that provides a documented framework for bringing together and organizing the resources for dealing with any event that harms or threatens the security of information. The goal of the Incident Response Policy is to facilitate a quick and efficient response to incidents, and to limit their impact while protecting information assets. The plan defines roles and responsibilities, documents the steps necessary for effectively and efficiently managing an information security incident, and defines channels of communication. The Information Security Officer and Chief Information Officer coordinate investigations of potential cybersecurity incidents.


text: Our internal processes, and controls are designed to contain, mitigate, or resolve cybersecurity incidents. As of the report date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "System Failure, Cybersecurity Breaches, Fraud and Employee Misconduct Could Subject the Company to Increased Operating Costs, as Well as Litigation and Other Potential Losses" in Item 1A. Risk Factors.


text: As mentioned, the Company's Information Security Officer is primarily responsible for managing and updating the information security program. The responsibilities for managing the information security program include cybersecurity risk assessment, assessing the types and appropriateness implemented controls and coordinating related control testing, coordinating user training with each department and the appropriateness, data storage and maintenance, incident response, and third-party risk management. Specifically, the information technology department, as a whole, consists of information security professionals with varying degrees of education and experience with senior management in department having higher professional education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, the Company's Information Security Officer and Chief Information Officer have relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate actions taken the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.


text: The Company employs a combination of patch management, network security, malicious code prevention, and user awareness and training to assist with preventing cybersecurity incidents. Users are made aware of policies and procedures regarding appropriate use of networks, systems, and applications. Additionally, employees are trained in handling sensitive data and made aware of specific requirements when handling client data. Review and assessment of network infrastructure is completed, periodically. The Company, in certain instances, may rely on vendors, third-party support, or other outsourcing opportunities. Before introducing a new product or service, the internal controls and competence of a vendor, maintenance and upkeep of a third-party provider's systems, and financial condition of the third-party vendor are evaluated. Internal and external auditors and independent external partners are engaged and periodically review the Company's processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. LNC's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: The governance, risk and compliance division of the Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the company's most significant IT and cyber risks, the results of which are leveraged by IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.


text: The work done by the Information Security team integrates into the LNC's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on LNC's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, LNC's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the IT leadership team and the Audit Committee of LNC's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.


text: While the Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.


text: Monitoring and Incident Response The CSRI division of the Information Security team is responsible for the operation of LNC's internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of LNC's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from LNC's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.


text: The Privacy team, which is part of the compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into the Information Security incident response program. The Information Security team works closely with the Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.


text: LNC's Board of Directors is responsible for regular oversight of LNC's overall risk management process. The Board reviews the most significant risks the company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the LNC Board of Directors.


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer and Head of IT ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.


text: The current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third-party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer (" CISO ") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.


text: Information security and data privacy have been, and continue to be, vitally important to the Company. Our Board, in coordination with the Audit Committee, provides oversight of the Company's major information technology risk exposures, including those related to cybersecurity, data privacy and data security, and oversees the steps management has taken to monitor and mitigate such risk exposures. Cybersecurity and related matters are recurring topics at Audit Committee meetings and the Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") regularly provide the Audit Committee, and periodically the entire Board, with updates on the Company's cybersecurity risk profile and strategy. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 38-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our governance, risk and compliance team conducts due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), integrated into our enterprise crisis management and business continuity program, which provides protocols and procedures for evaluating and responding to material cybersecurity incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity event.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 39-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber or other data security incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our IT governance, risk and compliance team conduct due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), which provides protocols and procedures for evaluating and responding to material cybersecurity and other data security incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity or data security event.


text: As of the date of this report, no cybersecurity or data security incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."


text: We recognize the importance of maintaining the safety and security of our people, systems, and data and have a holistic process, supported by our management and Board of Directors, for overseeing and managing cybersecurity and related risks. As part of AES, we are also supported by AES' cyber risk management program.

companyName: IPALCO ENTERPRISES, INC.


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2020.


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cyber security professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.


text: The Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.


text: We consider cybersecurity as part of the enterprise risk process, including organized and structured reporting protocols. The prioritization of cybersecurity risk is aligned with overall risk management processes.


text: In addition, the Company's management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. The Company's CEO, CFO and other members of senior management participate in such meetings.


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and the Board. We regularly practice our incident response through executive tabletop exercises.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are informed by frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program addresses threats in a prioritized manner and, in particular, focuses on the following key areas: • gap analysis to identify programmatic opportunities for improvement that can be incorporated into the cyber strategy; • policies and standards that are annually reviewed and communicated; • exceptions management and internal audits that support cybersecurity requirements through assessing control implementation risks; and • monitoring and regular reporting of cyber resilience and posture at operational and strategic levels.


text: We engage assessors, consultants, auditors, or other third parties in connection with any such processes, including: • external vulnerability assessments, including penetration tests; • internal audit reviews; • threat intelligence; • incident management; • audits of NERC-Critical Infrastructure Protection regulated environments by the NERC Registered Regional Entity; and • program development support, as needed.


text: Our risk management program for third-party service providers includes risk-based assessments of their interactions with our data and systems. We implement monitoring and response processes for key third-party service providers.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in training, including phishing exercises, monthly safety meetings, and an annual cybersecurity awareness update. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Potential security breaches (including cybersecurity breaches) and terrorism risks could materially and adversely affect our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy While cybersecurity risk can never be eliminated entirely, we devote significant resources to our cybersecurity program that we believe is reasonably designed to mitigate our cybersecurity and information technology ("IT") risks—which include, among others, unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. Cybersecurity risk management processes have been integrated into the Company's overall risk management system, including our ERM process. Threats to our cyber/digital landscape are regularly identified and then assessed in terms of their potential business impact. Mitigation strategies are developed based on our assessment of the potential business impact (both quantitatively and reputationally) of the threat. Because a cybersecurity threat can have implications beyond IT, the Company draws on cross-functional expertise to determine the potential business impact and proportional mitigation efforts or solutions. This expertise may involve third-party resources with functional expertise related to the specific threat or business impact. As part of our risk management profile, we regularly review available cybersecurity data regarding our business partners (suppliers, dealers, third-party service providers and others) and regularly engage with them on risk mitigation efforts.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company e-mail and access to Company assets.


text: When a cybersecurity incident is detected, our response is governed by our IT Security Incident Response Policy, providing a rigorous, standardized process to ensure efficacy of the response. In general, when a cybersecurity incident is identified, our policy requires an initial review and triage of the incident. When a cybersecurity incident is determined to be significant, it is brought to the attention of a cross-functional leadership team consisting of our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Human Resources Officer and General Counsel and is addressed by that team, along with other internal stakeholders, using processes that leverage subject-matter expertise from across the Company. As with risk mitigation, we may engage third-party advisors, from time to time, as part of our incident response and management process. As part of our risk mitigation efforts, we also maintain cybersecurity insurance to defray the costs of potential information security breaches.


text: In fiscal 2024, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with quarterly reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: Reporting directly to our Chief Operating Officer, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.


text: In fiscal 2025, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with semi-annual reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: Reporting directly to our General Counsel, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.


text: Cybersecurity Risk Management and Strategy The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer ("CISO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: The Company's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and routine vulnerability scans, and a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.


text: We maintain policies and procedures for the safe storage, handling and secure disposal of customer information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could, ultimately, place sensitive customer or employee information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails targeting employees. We test employees monthly to determine their susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), Chief Legal Officer ("CLO") and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.