text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ internal resources and, regularly, external resources, to evaluate our environment, information systems, and processes.


text: Through appropriate risk evaluation, security assessments, and financial due diligence, we seek to protect the security and confidentiality of information provided to our vendors under service provider cloud computing or other arrangements. We also employ contractual nondisclosure requirements and use limitations consistent with our published Privacy Policy, and typically reserve the right to review third-party compliance against the required standards, where we deem appropriate.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR

secItem: Item 1C


text: Our response to cybersecurity threats is triggered through various means. Through annual user awareness training, we teach our employees to identify and appropriately respond to such threats. Our incident response program is designed to mitigate and recover from suspected and actual cybersecurity incidents and provide all required consumer and regulatory notices regarding cybersecurity threats in a timely manner.


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the Chief Executive Officer, other members of the executive team, and the Board of Directors' Technology Committee. Our CSO has served in this capacity at Progressive for more than 11 years and, prior to joining us, had over 10 years of cybersecurity experience in the banking industry. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology and cybersecurity experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks rapidly evolve and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data and information that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.


text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ a variety of internal resources to evaluate our environment, information systems, and processes. In addition, we engage third parties to test the vulnerability of our cybersecurity infrastructure on a regular basis and we have a third-party assessment performed annually.


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the CEO, other members of the executive team, and the Board of Directors' Technology Committee. Assuming the role in 2012, our CSO has served in this capacity at Progressive for more than a decade and, prior to joining us in 2010, had over 10 years of cybersecurity experience in the banking industry in security and risk management leadership roles, primarily focused on cybersecurity and banking compliance, with additional experience in the areas of anti-money laundering and financial fraud. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks evolve rapidly and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.


text: PSCo is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: PUBLIC SERVICE CO OF COLORADO


text: The Company's information technology systems, as well as those of the Company's third party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of or disruptions in the information technology systems of the Company or its third party service providers, could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.

companyName: PUBLIX SUPER MARKETS INC


text: The Board of Directors and Audit Committee have oversight responsibility for the Company's cybersecurity risks. While the Company's employees play a key role in cybersecurity, the Company's Chief Information Officer, General Counsel and other members of management have shared responsibility for assessing and managing the Company's cybersecurity risks. The Company's management has sufficient knowledge, experience and expertise for assessing and managing the Company's cybersecurity risks. The Board of Directors and Audit Committee receive updates from management regarding cybersecurity risks, cybersecurity threats that could impact the Company and cybersecurity initiatives to enhance the Company's cybersecurity practices. The Audit Committee also receives updates on the results of assessments and audits of the Company's information technology systems and controls.


text: The Company has information technology security practices to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: • cybersecurity controls embedded in the Company's information technology systems; • implementation of changes to address potential threats and vulnerabilities of the Company's information technology systems; • incident response program, including proactive simulations, to identify and manage cybersecurity threats, risks or incidents; • participation in industry forums and collaboration with peers; and • security awareness and data protection training for applicable employees.


text: The Company assesses cybersecurity risks and changes in the cyber environment and adjusts its practices as deemed appropriate. To date, risks from cybersecurity threats have not materially affected, or are not reasonably likely to materially affect, the Company's business strategy, financial condition or results of operations. Refer to Item 1A. Risk Factors in this Annual Report for additional information on risks related to the Company's business, including cybersecurity risks.


text: The Company's information technology systems, as well as those of its third party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of or disruptions in the information technology systems of the Company or its third party service providers, could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.


text: Additionally, the Company assesses and manages cybersecurity threats associated with the information technology systems of its third party service providers that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: As of the date of this report, we are not aware of any risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, individually or in the aggregate.


text: The Board, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. Management provides cybersecurity updates to the Audit Committee, at least quarterly, and material cybersecurity incidents are reported to the Board.


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Director, Global Security that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.


text: The Global Cyber Security team reports to the Chief Digital Information Officer ("CDIO"), who in turn reports to the Chief Executive Officer ("CEO"). Refer to the "Information about our Executive Officers" section, which appears in Item 4(a) of this report for more information about the CDIO's relevant professional experience and qualifications.


text: Risk Management and Strategy Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into five categories: identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinates the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity products. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties and including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks. In response to these risks, we have implemented cybersecurity processes, technologies, and controls detailed below to aid in our efforts to assess, identify, and manage cybersecurity risks. Our Global Cyber Security team works to identify, assess and manage cybersecurity threat risks, their severity, and potential mitigations.


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Senior Director, Cybersecurity and Compliance that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data security and privacy, enterprise risk management, cloud security and ethical hacking.


text: Risk Management and Strategy Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into six categories: govern, identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinate the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity tools and program. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: Our executive leadership team is responsible for the global risk management framework and influences the culture of risk management within the Company. Additionally, our Board is responsible for oversight of the executive leadership team's approach to risk management and cybersecurity strategy. The Board recognizes the importance of maintaining security and the trust of our customers, clients, business partners and associates. The Company has developed a cybersecurity program founded on a strong management approach, policy driven governance, standards and procedures, and execution of a comprehensive strategy that adapts to changing risks. The Company's cybersecurity policies and standards are fully integrated into our overall risk management process and were created based upon the National Institute of Standards and Technology cybersecurity framework and other applicable industry standards. The Company endeavors to manage cybersecurity risks through a comprehensive and multidisciplinary approach that emphasizes confidentiality, security, and availability of our information by deploying processes to support identification of cybersecurity threats and using tools for prevention and mitigation of cybersecurity incidents. To the extent that cybersecurity incidents may occur, the Company has established cross functional procedures that enable a prompt and effective response to cybersecurity incidents.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Risk Management and Strategy Our global risk management policy provides a uniform approach for monitoring, identifying, measuring and responding to enterprise-wide risk to minimize potential disruptions to business operations and harm to reputation. Our global risk management policies framework encompasses, enterprise risk management, business continuity and cybersecurity. Cybersecurity risk is a key component of our overall global risk management policy. The Company's cybersecurity program is focused on the following areas: • Governance: In furtherance of the Board's risk management oversight goals, the Company convenes a Risk Committee comprised of key functional and business leaders. Among other members, the Risk Committee includes our Chief Information Security Officer ("CISO"), our Director of Global Risk and Property Management, our Vice President, Internal Audit, and our Vice President, Environmental, Health and Safety. This diverse group supports a strong focus on cybersecurity, business continuity, and associated enterprise risks. The Risk Committee's members are charged with, among other things, identifying and assessing significant and emerging risks, as well as working with executive leadership teams to develop and execute plans, responses and mitigation strategies to address significant cybersecurity risks, that could otherwise negatively impact our ability to achieve our objectives. The Risk Committee's cybersecurity management function addresses the Company's information security challenges and risks from various IT-related sources. • Collaborative Approach: The Company has developed and implemented a robust approach to identify, prevent and mitigate cybersecurity threats and incidents. This is supported by clear and direct cross-functional escalation paths to ensure proper handling and analysis so that decisions regarding response, materiality and any resulting disclosure and reporting of such incidents are clearly allocated and can be made in a timely manner. • Technical Safeguards: The Company employs industry accepted security tools, techniques, and system monitoring to protect the confidentiality of our systems and data. Maintaining the privacy and security of our associate, customer, and supplier data is paramount. The company deploys technical safeguards which include, but are not limited to, encryption, multi-factor authentication, network segmentation, privilege access management and, endpoint detection and response. These safeguards are evaluated on a routine basis with the intention of identifying and remediating potential vulnerabilities and enhancing the overall security framework. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive cyber incident response policy. This policy provides direction and guidance to address and manage security incidents, including identification, classification, and response. • Third-Party Risk Management: The Company maintains a risk-based approach to third party engagement and the cybersecurity risks associated therewith. This approach adheres to Company-policy, which includes regularly evaluating and identifying material risks from cybersecurity threats associated with third parties' access to our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides annual mandatory global information security training and certification for personnel regarding cybersecurity threats. This training is offered in 20 languages to maximize associate accessibility and comprehension. Additionally, the Company administers monthly targeted trainings and phishing simulations for our associates. These activities are designed to develop a mature and vigilant, risk-aware culture among our associates.


text: The Company completes periodic assessments and testing of its practices addressing cybersecurity threats and incidents. These efforts include, but are not limited to, audits, assessments, tabletop exercises, and vulnerability testing and are focused on evaluation of cybersecurity policy efficacy. These assessments and testing efforts are supported by third-party consultants who specialize in cyber-risk mitigation. The results of these third-party engagements are used to inform enhancements and adjustments to our cybersecurity policies and practices.


text: Our full Board is responsible for the oversight of the Company's operational and strategic risk management processes. Our Board believes that oversight of risk management belongs at the full Board level rather than with any single committee, primarily because of the importance of understanding and mitigating risk to the overall success of our Company. As part of its risk management responsibilities, our full Board provides oversight of the Company's management and mitigation of cybersecurity risks.


text: To gather information about risks to the organization, including cybersecurity, the Risk Committee identifies primary areas that generate enterprise risk and then distributes a survey to a group of our top leaders. The Risk Committee periodically summarizes its activities and findings (including the results of its survey and heat map analysis) related to cybersecurity and other risks directly to our CEO, as well as the Audit Committee and our full Board. The Risk Committee's work is also used by our management team as part of our disclosure controls and procedures to ensure that information regarding material risks applicable to the Company are appropriately disclosed in our public filings.


text: While our Board maintains responsibility for oversight of all areas of risk management, it relies on our Audit Committee to address significant financial risk exposure we may face and the steps management has taken to monitor, control and report such exposures. These risks are further reported to the full Board, as appropriate.


text: The Risk Committee receives prompt information regarding any cybersecurity incident in accordance with our cyber incident response policy and crisis communication procedures. The Risk Committee, in concert with the executive leadership team, evaluate this information and escalates notice to the Board, as appropriate.


text: The CISO works collaboratively with the Risk Committee. The CISO has implemented and monitors a program designed to protect the Company's information systems and to promptly respond to any cybersecurity incidents in accordance with the documented incident response plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are engaged to identify, classify, and address cybersecurity threats and incidents. Through prompt notifications and ongoing communications, the CISO and other key management personnel work to monitor, prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The Company's cybersecurity programs are supported by experienced and knowledgeable leaders. The CISO has served in various roles related to information technology and information security for over 20 years. The CISO maintains relevant certifications, including Certified Information Systems Security Manager ("CISM") and Certified Information Systems Auditor ("CISA"). Additionally, several cybersecurity team members reporting directly to the CISO maintain certifications, including CISM, CISA and Certified Information System Security Professionals ("CISSP"). The Company's Chief Digital & Information Officer has over 30 years of experience with information technology and digital strategy. The Company's CEO, CFO and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including those resulting from previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Risk Management and Strategy Our global risk management policy provides a uniform approach for monitoring, identifying, measuring and responding to enterprise-wide risk to minimize potential disruptions to business operations and harm to reputation. Our global risk management policies framework encompasses, enterprise risk management, business continuity and cybersecurity. Cybersecurity risk is a key component of our overall global risk management policy. The Company's cybersecurity program is focused on the following areas: • Governance: In furtherance of the Board's risk management oversight objectives, the Company convenes a Risk Committee comprised of key functional and business leaders. Among other members, the Risk Committee includes our Chief Information Security Officer ("CISO"), our Senior Director of Global Risk and Property Management, our Vice President, Internal Audit, our Vice President, Environmental, Health and Safety and members of the Legal and Compliance teams. This diverse group supports a strong focus on cybersecurity, business continuity, and associated enterprise risks. The Risk Committee's members are charged with, among other things, identifying and assessing significant and emerging risks, as well as working with executive leadership teams to develop and execute plans, responses and mitigation strategies to address significant cybersecurity risks, that could otherwise negatively impact our ability to achieve our objectives. The Risk Committee's cybersecurity management function addresses the Company's information security challenges and risks from various IT-related sources. • Collaborative Approach: The Company has developed and implemented a robust approach to identify, prevent and mitigate cybersecurity threats and incidents. This is supported by clear and direct cross-functional escalation paths to ensure proper handling and analysis so that decisions regarding response, materiality and any resulting disclosure and reporting of such incidents are clearly allocated and can be made in a timely manner. • Technical Safeguards: The Company employs industry accepted security tools, techniques, and system monitoring to protect the confidentiality of our systems and data. Maintaining the privacy and security of our associate, customer, and third-party data is paramount. The Company deploys technical safeguards which include, but are not limited to, encryption, multi-factor authentication, network segmentation, privilege access management and, endpoint detection and response. These safeguards are evaluated on a routine basis with the intention of identifying and remediating potential vulnerabilities and enhancing the overall security framework. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive cyber incident response policy. This policy provides direction and guidance to address and manage security incidents, including identification, classification, and response. • Third-Party Risk Management: The Company maintains a risk-based approach to third party engagement and the cybersecurity risks associated therewith. This approach adheres to Company-policy, which includes regularly evaluating and identifying material risks from cybersecurity threats associated with third parties' access to our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides annual mandatory global information security training and certification for personnel regarding cybersecurity threats. This training is offered in 20 languages to maximize associate accessibility and comprehension. The Company administers monthly targeted trainings and phishing simulations for our associates. Training sessions and additional phishing simulations are automatically deployed based on success and failure rates. In October 2024, the Company observed Cybersecurity Awareness Month with additional opportunities for engagement, interactive training and education. These activities are designed to develop a mature and vigilant, risk-aware culture among our associates.


text: The Company's cybersecurity programs are supported by experienced and knowledgeable leaders. The CISO has served in various roles related to information technology and information security for over 20 years. The CISO maintains relevant certifications, including Certified Information Systems Security Manager ("CISM") and Certified Information Systems Auditor ("CISA"). Additionally, several cybersecurity team members reporting directly to the CISO maintain certifications, including CISM, CISA and Certified Information System Security Professionals ("CISSP"). The Company's Chief Digital & Information Officer has over 30 years of experience with information technology and digital strategy. The Company's CEO, CFO and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies or in related settings, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including those resulting from previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. condition. The cybersecurity threat environment is increasingly challenging. While we employ various measures to improve our cybersecurity posture and protect against evolving threats, we cannot guarantee that these measures will always be successful. For more information, please refer to Part I - Item 1A - Risk Factors – Risks Relating to the Legal and Regulatory Environment – "Our operations are highly dependent on information technology infrastructure, and failures, attacks or breaches could significantly affect our business" in this Annual Report on Form 10-K.


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Risk Management and Strategy Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include:


text: Advanced, next-generation endpoint security software, detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident.


text: Privilege management software provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment.


text: The Company employs email security tools provided and managed by our Provider to protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: The Company utilizes various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. The Company obtains System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: The Company requires all devices used by employees to be protected with the security measures listed above. It is also Company policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, the Company has not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: We do not employ a Chief Information Officer. The Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.


text: Risk Management and Strategy Due to the our size, our information technology ("IT") environment does not utilize overly complicated systems or processes. We do not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet our needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. We use multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include: • Advanced, next-generation endpoint security software, which detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident. • Privilege management software, which provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment. • Email security tools provided and managed by our Provider, which protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: We utilize various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. We obtain System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: We require all devices used by employees to be protected with the security measures listed above. It is also our policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the National Institute of Standards and Technology's (NIST) Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the International Organization for Standardization (ISO), and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.

companyName: ROGERS CORP

ticker: ROG


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within the Company to evaluate and adjust our detection and mitigation strategies.


text: We impose security requirements upon our suppliers, including maintaining an effective security management program, abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Chief Information Officer (CIO) is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Senior Manager of Information Security. Our CIO has more than 25+ years of information technology and cybersecurity experience, and has served in this role since 2021.


text: Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks. The enterprise risk management program is utilized in making decisions with respect to company priorities, resource allocation, and oversight structures. Our CIO delivers updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives. These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to the Company's peers and other third parties. Our CIO will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed. Furthermore, our CIO provides periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect the company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the NIST's Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the ISO, and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within our Company to evaluate and adjust our detection and mitigation strategies.


text: Our CIDO is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Director of Information Security and Compliance.


text: Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks. The enterprise risk management program is utilized in making decisions with respect to our Company's priorities, resource allocation, and oversight structures. Our CIDO and/or Director of Information Security and Compliance deliver updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives. These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to our Company's peers and other third parties. Our CIDO and/or Director of Information Security and Compliance will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed. Furthermore, our CIDO and/or Director of Information Security and Compliance provide periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect our Company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, in the risk factor entitled " A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results" under Item 1A, Risk Factors, of this report.

companyName: ROYAL GOLD INC

ticker: RGLD


text: The Senior Vice President and Chief Financial Officer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee ("AFC") of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.


text: Our cybersecurity program is designed to protect the integrity of our information and the proper functioning and availability of the information systems that help operate our business. We utilize the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) to inform our cybersecurity program and maintain International Organization for Standardization 27001 (ISO 27001) certification. We have created and implemented processes that assess, identify, respond to and manage cybersecurity threats and incidents, and we oversee these processes to minimize the occurrence and impact of any unauthorized access, disruption or use of our information or that of our customers. We have a robust set of information security policies related to encryption of data, anti-virus, firewalls, multi-factor authentication, training of employees, as well as incident response capabilities designed to proactively identify risks and mitigate attacks and unauthorized access attempts to our systems, amongst other measures.

companyName: RYDER SYSTEM INC

ticker: R


text: Our cybersecurity program is evaluated by both our management and board of directors. Our Chief Information Officer supervises our cybersecurity program, and our Chief Information Security Officer (CISO) manages its daily operation. Our CISO has over two decades of experience in the cybersecurity and risk management fields, including over 15 years of experience leading cybersecurity oversight, as well as various industry-recognized certifications, such as the Certified Information Systems Security Professional and Auditors certifications. The CISO provides quarterly reports to the audit committee of our board of directors, which is responsible for overseeing cybersecurity and information technology and notifying the board of directors of any significant risks or updates. These reports may include updates on our enterprise-wide cybersecurity strategy, policies, processes and standards, as well as potential cybersecurity or information technology risks and threats. Our cybersecurity program is also evaluated at least annually by external experts, and the results of those reviews are reported to our leadership team and the board of directors. Cybersecurity risk is also evaluated as an enterprise-wide risk via our enterprise risk management program, which is reviewed by our leadership team and the board of directors. All employees are required to complete semiannual cybersecurity trainings and have access to more frequent cybersecurity trainings through online simulations. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity attacks and other breaches of our systems and information technology.


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems, networks and information, and those of our third-party providers and customers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity incidents and other breaches of our systems and information technology.


text: Risk management and strategy The Company has implemented technologies and tools to evaluate its cybersecurity protections and maintain a cyber risk management strategy related to its technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Risk Identification The Company's Chief Information Security Officer ("CISO") and Cybersecurity team are actively engaged within the cybersecurity community in order to monitor emerging trends and developments and share best practices for identifying and mitigating cyber threats. For example, the Company participates in threat intelligence information-sharing networks, such as the Financial Services Information Sharing and Analysis Center (FS-ISAC). The Company also tracks industry and government intelligence sources for information about evolving cyber threats and deploys updates to its systems, as appropriate. The Company's Cybersecurity team monitors and investigates suspicious events.


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Company's Chief Technology and Operations Officer review and approve the cybersecurity assessment. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.


text: On an annual basis, under the direction of the Company's Chief Risk Officer, the Company's Technology, Cybersecurity and Business Resiliency groups also participate in the enterprise-wide Own Risk and Solvency Assessment ("ORSA"), which outlines identified risks and describes the controls in place across the Company to address those risks. The ORSA is reviewed with the Company's lead regulator, the State of Connecticut Department of Insurance, which in turn performs periodic financial examinations, including a technology control assessment.


text: In addition, the Company regularly self-assesses against its internal policies, using its internal risk assessment process and a variety of frameworks, such as the New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies, the Insurance Data Security Model Law as adopted and modified by various states and the Payment Card Industry Data Security Standard.


text: As the workforce, the work environment and the threat landscape continue to evolve, the Company seeks to evaluate related risks and implement appropriate controls.


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: The Company uses technologies and tools, as appropriate, to enhance cybersecurity, such as multifactor authentication, encryption, firewalls, intrusion detection and prevention systems, endpoint detection and response, vulnerability scanning, penetration testing, patch management and identity and access management systems. These systems are designed, implemented and maintained with the goal of identifying, assessing and managing cybersecurity risks. In addition to its internal cybersecurity team, the Company uses internal and external auditors and, as appropriate, third-party consultants, service providers and assessors to review and test its processes.


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity related information through a number of different methods, including event-triggered awareness campaigns, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has a Security Incident Response Framework in place. The framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party risk assessments, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms.


text: To date, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—If we experience difficulties with technology, data and network security (including as a result of cyber attacks), outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted."


text: The Risk Committee of the Board, consistent with its charter, reviews and discusses with management the strategies, processes and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The CISO typically provides quarterly updates regarding cybersecurity and cyber risk to executive management and the Risk Committee of the Company's Board of Directors.


text: The CISO leads the Company's cybersecurity department. The CISO reports to the Chief Technology and Operations Officer and is a member of the Enterprise Risk team and the Company's Disclosure Committee. The CISO has over 20 years of cybersecurity and information security risk compliance and threat analysis experience. Prior to joining the Company in 2023, the CISO served as Chief Security Officer for a national telecommunications service provider. Under the direction of the CISO, the Company's Cybersecurity department analyzes cybersecurity and resiliency risks to the Company's business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term strategies, which are executed through a collaborative effort within Technology, Cybersecurity and Business Resiliency and are communicated to the Risk Committee of the Board of Directors on a regular basis.


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Chief Financial Officer of the Company's Technology group review and approve the cybersecurity assessment. The Company's Chief Technology and Operations Officer reviews and approves the list of emerging, strategic and transformative risks upon which the Enterprise Risk Management team's cybersecurity risk and control assessment processes are based. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance, Technology, and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as artificial intelligence (AI) related risks, phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity information through a number of different methods, including awareness campaigns, gamified activities, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has a Security Incident Response Framework (Framework) in place. The Framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the Framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party service providers, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms. Additionally, our Procurement group has a framework to help identify and mitigate supplier risks, as well as enable management to make risk informed decisions.


text: Cybersecurity Risk Management and Strategy Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and availability of the information that Seaboard collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Managing Material Cybersecurity Risks Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs assessments and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. These action plans are included on a multi-year roadmap that addresses priority, funding and implementation. These risks are evaluated on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests; Seaboard engages independent third parties to perform some services such as a penetration test; Seaboard maintains end user and administrative user policies governing the use of company technology.


text: Overseeing Third-Party Cybersecurity Risk Seaboard's information security program includes a documented process to oversee, identify and mitigate cybersecurity risk associated with Seaboard's use of new third-party service providers. As part of this process, prior to onboarding a third-party service provider, designated information security personnel from each segment will work with the internal business sponsors to perform a cybersecurity risk assessment and determine the potential impact on Seaboard's systems, data and networks if an identified cybersecurity breach were to occur. Risk assessments are documented, and reports are shared with the Information Security Team and others responsible for accepting the risk tolerance and monitoring the risks going forward.


text: Risks from Cybersecurity Threats As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure.


text: Cybersecurity Governance Seaboard acknowledges the importance of effectively managing risks linked to cybersecurity threats. Seaboard has implemented oversight mechanisms to ensure effective governance in handling risks linked to cybersecurity threats because of the impact these threats can have on operational integrity and stakeholder confidence.


text: Cybersecurity Risk Management Personnel Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the "IS Director"). The IS Director, whose experience includes over seven years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.


text: Management's Role Managing Cybersecurity Risk and Board of Director Oversight The IS Director and the Information Security Team communicate guidance to all divisional information security personnel to ensure consistent execution of cybersecurity risk management activities. Updates on divisional cybersecurity risks, compliance and roadmap status are provided on at a least a quarterly basis to Seaboard's CEO and CFO for purposes of risk monitoring, updates to policies, allocation of resources, feedback on roadmap progress and discussions on threat remediation, among other topics.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects to strengthen Seaboard's information security systems, assessments of Seaboard's security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan expenditures. Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receives prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: Cybersecurity Risk Management and Strategy Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders with the security of its data and information systems. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. These frameworks and standards serve as guides and references. Seaboard adapts them to its specific environment, needs and industries. They are not meant to imply that Seaboard meets, or fully complies with, any specific technical standards, specifications or requirements set forth within them. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and accessibility of the information that Seaboard collects and stores, supporting legal and regulatory compliance and preventing disruptions to business operations. Seaboard's information security program monitors the systems and networks Seaboard relies upon for threats, breaches, intrusions and potential other weaknesses; assesses the security of company-wide software, applications and systems; responds to cybersecurity incidents; and facilitates training for employees.


text: Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs various reviews and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. Risks are evaluated at least on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests.


text: Seaboard engages independent third parties to perform some services such as penetration testing and monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment and investigation by Seaboard's Information Security Team. Seaboard maintains end user and administrative user policies governing the use of company technology. Seaboard conducts risk assessments of certain of its third-party service providers with attention to cybersecurity risks.


text: As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure. Cybersecurity risks that may materially impact Seaboard are discussed in more detail in Item 1A "Risk Factors," under the heading "Operational Risks," which should be read in conjunction with this Item 1C.


text: Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the " IS Directo r"). The IS Director, whose experience includes over eight years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.


text: The IS Director and the Information Security Team communicate guidance, including various alerts to monitor and assess threats, to information security personnel in all segments to ensure consistent execution of cybersecurity risk management activities. Updates on segment-level cybersecurity risks, compliance and implementation status are provided on at least a quarterly basis to Seaboard's Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") for purposes of risk monitoring, updates to policies, allocation of resources, progress on action plans and discussions on other topics as necessary.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects supporting Seaboard's information security systems, assessments of Seaboard's information security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan improvement expenditures.


text: Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receive prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to "Risk Factors" for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:

companyName: SPX Technologies, Inc.

ticker: SPXC


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: Risk Assessment and Technical Safeguards On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.


text: Board and Management Oversight Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: Risk Management and Strategy As part of our overall enterprise risk management strategy, our cybersecurity processes seek to help the Company prevent or mitigate potential cybersecurity incidents, and to detect and remediate them quickly when they occur. To achieve this, the Company uses a broad selection of security tools and methodologies to assess, identify and manage material risks from cybersecurity threats.

companyName: SEMTECH CORP

ticker: SMTC


text: Key aspects of our cybersecurity risk management and threat mitigation strategy include: • Maintaining our ISO/IEC 27001:2022 certification and using it along with other common security frameworks to help assess, identify, and manage material risks from cybersecurity; • Utilizing dedicated IT Security Operations and Product Security teams focused on monitoring, enforcing and improving cybersecurity throughout the enterprise; • Engaging and training internal stakeholders from representative aspects of the business (product and functional teams) on our Incident Response and Reporting plan on a quarterly basis; • Maintaining and regularly testing our disaster recovery and business continuity plans; and • Creating information security awareness among our employees and partners through the use of phishing exercises and regular cyber-awareness articles & newsletter campaigns.


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to continue the vendor's engagement based on their cybersecurity risk profile.


text: As part of our processes, we also engage third parties and industry experts to conduct audits and other assessments of our cybersecurity system. These assessments include vulnerability assessments, penetration testing and table-top exercises. The results of these reviews help to identify areas for continued focus, improvement and/or compliance. We also regularly evaluate our cybersecurity position against benchmarks of our peers and industry leaders, and expect our strategy and management approach to change as the general cybersecurity landscape evolves.


text: Consistent with our overall risk management governance structure, the Vice President of IT Security is responsible for the day-to-day management of cybersecurity risk, while our Board and its Audit Committee play an active, ongoing oversight role.


text: The Audit Committee or the full Board receive quarterly cybersecurity updates, which are prepared by our Vice President of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.


text: The Vice President of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the Vice President of IT Security provides regular updates about cybersecurity incidents to the Audit Committee, the Chief Operating Officer and other members of the executive management team.


text: Our Vice President of IT Security has held IT security and leadership roles at the Company for over 23 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. For additional information on our cybersecurity risks, see "Item 1A. Risk Factors – We rely on certain critical information systems for the operation of our business and a disruption in our information systems, including those related to cybersecurity, could adversely affect our business operations."


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to move forward with the vendor's engagement based on their cybersecurity risk profile.


text: Consistent with our overall risk management governance structure, the Vice President of IT Infrastructure and Security ("VP of IT Security") is responsible for the day-to-day management of cybersecurity risk, while our Board of Directors and its Audit Committee play an active, ongoing oversight role.


text: The Audit Committee or the full Board of Directors receive quarterly cybersecurity updates, which are prepared by our VP of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.


text: The VP of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the VP of IT Security informs executive management regarding cybersecurity risks and incidents and provides regular updates about cybersecurity incidents to the Board, the Chief Operating Officer and other members of the executive management team as well as to the Audit Committee and the Board of Directors, as appropriate.


text: Our VP of IT Security has held IT security and leadership roles at the Company for over 24 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: Risk Management and Strategy We recognize the necessity of a flexible and dynamic cybersecurity risk management strategy to defend against threats in a fast-changing digital world. For this purpose, we have invested in building a cybersecurity infrastructure to protect our information systems and secure our data from cyberattacks. Our information security program features risk management strategies, security awareness training, security operations, incident response, security governance, third-party risk management, IT security risk management, security architecture, and vulnerability management.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: 20 Service Corporation International Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, and data breaches. Our program is regularly assessed using the NIST Cybersecurity Framework, and information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: Engage External Experts on Risk Management To effectively target emerging cybersecurity threats, our information security program engages with a diverse group of third-party external experts, including cybersecurity assessors, consultants, and auditors for cybersecurity risk management. Our partnerships with these third party professionals feature regular audits, assessments, and simulated testing.