text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning processes.


text: We have a third-party risk management program that assesses the inherent risks of third-party service providers and informs our due diligence and continuous monitoring of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and controls, of prospective and existing service providers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG

secItem: Item 1C


text: We manage cybersecurity incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to cybersecurity and privacy risks, and reviews information technology's program to monitor and assess information security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.


text: Our CISO has primary responsibility for our cybersecurity program and the management and oversight of our information security department. Our CISO has nearly 25 years of experience in information technology, including 14 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes Berkshire and the Business Groups, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: The Audit Committee of Berkshire's Board of Directors has responsibility for oversight of Berkshire's cybersecurity risk management program. The Audit Committee receives periodic reports regarding the number of and impact from cybersecurity incidents reported through Berkshire's cybersecurity incident reporting process. Additionally, the Audit Committee is updated on cybersecurity trends and related issues. Furthermore, the Audit Committee approves and receives updates on the workplan performed by Berkshire's internal audit group that focuses on information technology and cybersecurity risks. This includes audit procedures related to internal and external penetration testing, attack simulations, vulnerability assessments, cybersecurity program reviews and other audits designed to investigate specific risks. The frequency of these updates is determined by the Audit Committee in conjunction with Berkshire's senior management. In addition to the Audit Committee's oversight, the senior management of Berkshire's Businesses Groups are responsible for the day-to-day operations of protecting their businesses' information systems. Each Business Group is required to report significant cybersecurity events to Berkshire. Berkshire's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.


text: Cybersecurity Governance The Company's entire Board of Directors is engaged in risk management oversight, including the oversight of risks from cybersecurity threats. The Audit Committee assists the Board of Directors in its oversight of Domino's company-wide risk management and the process established to identify, assess, measure, monitor and manage risks, including major information security and cybersecurity risks, with input from the Company's internal committee dedicated to assessing and managing enterprise risk comprised of Company executives in addition to other senior leaders within the Company (the "Enterprise Risk Committee").

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Cybersecurity Risk Management and Strategy Cybersecurity is a key component of the Company's overall risk management system, and the Company believes it has implemented robust processes that are designed to effectively manage risks from cybersecurity threats. In addition to maintaining insurance coverage to address cyber incidents, the Company has also implemented processes, procedures and controls to help mitigate these risks. Domino's cybersecurity program is embedded into the Company's enterprise risk management framework from both a resource allocation and strategic initiative perspective and is supported by an extensive catalog of layered security controls that are designed to prevent and detect internal and external security threats and safeguard privacy and personal data of customers, team members, franchisees and other business partners. Domino's maintains this comprehensive information security program with a dedicated team that is responsible for directing, coordinating, planning and organizing information security activities throughout the Company and is led by the Company's CISO.


text: The Company leverages a combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Critical Security Controls as the scale against which to assess its information security program and invest in its ability to proactively defend against security risks within its environment. Domino's conducts annual risk assessments, both internally and through the use of third parties, to evaluate the effectiveness of its security controls and identify new threats and vulnerabilities and appropriate controls to mitigate risks and supplements these regular assessments with ongoing monitoring. Additionally, Domino's participates in ongoing and periodic assessments of its external platform and applications to include running a responsible disclosure program to ensure that vulnerabilities that are discovered can be reported and appropriately remediated. Domino's has been certified as compliant with the Payment Card Industry Data Security Standard ("PCI DSS") standards and has several dedicated teams of specialists within its information security department that routinely conduct internal and external vulnerability and penetration assessments in accordance with both PCI DSS and industry accepted practices. This team keeps the Company's management informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents and leads the Company's processes to oversee and identify risks from cybersecurity threats associated with the Company's use of its third-party service providers. The Company additionally has established and maintains a dedicated Security Operations Center (SOC) team that is responsible for quickly identifying and treating events that could pose risk to its technology environments and that has a documented incident response plan in place, which is periodically tested, reviewed and updated as appropriate. The Company trains its team members through annual cybersecurity awareness training, phishing simulations and periodic communications about timely cybersecurity topics and threats.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Chief Financial Officer, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the Chief Financial Officer as well as to other executive management, including our General Counsel, on cyber matters, as appropriate.

companyName: PepGen Inc.

ticker: PEPG


text: Risk Management and Strategy Our business depends on our continued ability to collect and safeguard vast amounts of personal and sensitive business information, including, among other types of data, protected health information (PHI), employee information, credit card information, insurance information, proprietary and confidential information about our business, financial information, trade secrets, intellectual property, and the sensitive and confidential information from the third parties with whom we work. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and hardware and software, to safeguard and prevent unauthorized access to this critical data (collectively Information Systems and Data).

companyName: Tempus AI, Inc.

ticker: TEM


text: Our Chief Technology Officer, or CTO, and our Chief Information Security Officer, or CISO, together with our Enterprise Risk Management Committee help identify, assess, and manage the Company's cybersecurity threats and risks. Working with a cross-functional team, these individuals and our Enterprise Risk Management Committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, using external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Our Information Security program has six broad components: Controls & Compliance; Security Operations; Cloud Security; Identity and Access Management; Application Security; and Data Governance. Within each program component, and depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining a vulnerability management policy and disaster recovery/business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, a vendor risk management program, a dedicated cybersecurity staff/officer, active monitoring, detection, prevention, mitigation, and remediation strategies to ensure we are adequately safeguarding and protecting our critical information, routinely conducting audits, vulnerability scans, penetration tests, social engineering simulations, security awareness training, and threat intelligence assessments to ensure that our systems, policies, and procedures are operating as intended. We also engage with a range of external experts to help us evaluate and attest to our risk management systems, including maintaining a certification pursuant to ISO 27001 and conducting periodic third-party audits to maintain our certification.


text: In addition, we maintain a detailed Incident Response Plan to assist in responding to potential cybersecurity threats. Our Incident Response Plan addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies to prevent future incidents. Our Information Security and Privacy Teams conduct tabletop exercises twice per year to ensure preparedness for information security, including cybersecurity incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing and social engineering simulations. We also maintain cybersecurity insurance coverage.


text: Our Privacy program is designed to support and enhance our Cybersecurity program. We perform an annual HIPAA Security Risk Assessment, among other things, to help identify remediation priorities and to ensure we have implemented best practices in storing and safeguarding PHI.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Enterprise Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We frequently collaborate with other third-party service providers to conduct regular audits, threat assessments, and consultation on cybersecurity strategy, enhancements, and best practices. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and cloud infrastructure providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, review of the vendor's written security program, review of security assessments, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K, including "Cyber-based attacks, security breaches, loss of data and other disruptions in relation to our information systems and computer networks could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation."


text: Our cybersecurity risk assessment and management processes as well as our Information Security program are implemented and maintained by certain Company management, including our CTO and our CISO, who have 25 years of experience in cybersecurity and IT Operations respectively. Our CTO and CISO collaborate with a cross-functional team of seasoned professionals responsible for maintaining, improving, and promoting our Information Security program. In addition to the oversight by our Technology and Security leaders, representatives from our Information Technology, Legal, Privacy, Finance, Regulatory, Quality, and Compliance teams are integral to the successful implementation of our overall Information Security program.


text: The CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO and CTO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's Incident Response Plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Our CISO reports to the full Board of Directors quarterly, or more frequently as needed. These reports generally address each of the six components of our Information Security program, including the Company's progress on initiatives we have prioritized for the quarter. Our Audit Committee has general oversight responsibility for our data security practices, and we believe the Committee has the requisite skills and visibility into the risk profile of our Company to fulfill this responsibility effectively. Our CTO, CISO, or other members of our Enterprise Risk Management Committee report to the Audit Committee quarterly or on an as-needed basis.


text: Senior members of our management are responsible for assisting our CTO and CISO in managing cybersecurity risk. We maintain a cross-functional Enterprise Risk Management Committee, which meets monthly to identify, assess, mitigate, and remediate risks impacting the Company, including cybersecurity risks. Members of this committee include our CISO, CTO, Chief Financial Officer, Chief Privacy Officer, General Counsel, Chief Commercial Officer, Chief Scientific Officer, Chief Medical Officer, Chief Legal Officer, and the heads of our Regulatory and Quality teams. The Enterprise Risk Management Committee informs members of the Audit Committee regarding the overall enterprise risks identified by management, progress on remediation efforts identified in the prior quarter, and risk mitigation priorities for the forthcoming quarter.


text: Risk Management and Strategy The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and manage the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security and cybersecurity team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization ("ISO") and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains policies and procedures relating to our data collection, use and processing activities, as well as mechanisms for monitoring our data systems and usage. We do not have individual retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws in the countries in which we operate, including the GDPR, the U.K. Data Protection regime and the California Consumer Privacy Act (the "CCPA"). • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats in order to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use and storage of data.


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company, including our business strategy, results of operations, or financial condition, in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional updates as needed, on cybersecurity matters. Such updates address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, external threat intelligence, technological trends and cybersecurity considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Steering Committee, which includes our CEO, CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.


text: The CISO holds undergraduate and masters' degrees in computer science and cybersecurity, respectively, and has served in various senior roles in information technology and information security for over 20 years, including previously serving as the Chief Information Security Officer of a major global asset manager. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). The CIO holds undergraduate and masters' degrees in computer science and has served in various roles in information technology for over 30 years. The Company's CRO holds an undergraduate degree and has over 30 years of experience managing risks, including risks arising from cybersecurity threats.


text: Management and Board Oversight The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging cyber threat landscape. The Audit Committee also receives updates on cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to promptly report incidents to the Chief Financial Officer in accordance with the Company's incident response plan. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. While the Company is not aware of any cybersecurity incidents that have materially affected its business as of December 31, 2024, there can be no guarantee that the Company will not be the subject of future attacks, threats or incidents, that may have a material impact on its business strategy, results of operations or financial condition. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees the Company's cybersecurity risk profile, including risks from cybersecurity threats, and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company, and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Company's CIO has been and continues to be responsible for Global IT, including overseeing cybersecurity and its digital strategy. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at Rogers Corporation, a global high tech manufacturing company, as well as other global manufacturing companies.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as the Audit Committee, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Audit Committee at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. Our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, which includes disaster recovery, are designed to deliver resilience and comply with several regulatory requirements including DFARS/NIST 800-171 controls. For our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal or destroy data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an IT steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, CISO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.


text: As of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents since the ransomware incident in the fourth quarter of fiscal 2019 described under "Our operations are subject to cyberattacks that could have a material adverse effect on our business" in Part I, Item 1A of this Report, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks, and there can be no guarantees that such attacks will not occur in the future.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" and "We use AI in our business, and its use could result in reputational harm, competitive harm, cybersecurity risks and legal liability, which could have a material adverse effect on our results of operations" in Item 1A. Risk Factors.

companyName: SAIA INC

ticker: SAIA


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors. Our CISO has received certifications relating to information security, security leadership, and forensics from the Global Information Assurance organization.

companyName: CONTINENTAL RESOURCES, INC


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engage s a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; and the Director of Corporate Security. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO periodically briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Aimco OP L.P.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 25 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.


text: Cybersecurity Risk Management The Company has systems and processes for identification, assessment, and management of material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company's multi-faceted approach includes deploying applications and control activities to actively monitor and mitigate potential threats to the Company's IT environment.

companyName: TREX CO INC

ticker: TREX


text: These activities include, but are not limited to, engaging an external third-party to monitor information systems security events, conducting annual security training of employees, testing employees via periodic phishing campaigns, conducting system vulnerability scanning, utilizing a patching program to remediate critical patches, and utilizing an external third-party to perform testing to identify gaps in the Company's security program. The Company also performs third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. Additionally, for providers of software-as-a-service and other services that hold Company data, the Company reviews and assesses industry standard certifications such as System and Organization Controls (SOC) 1 or SOC 2 reports and cybersecurity preparedness questionnaires. Mitigation of risk efforts are coordinated by the Company's Director of Information Security, utilizing internal resources and third-party providers.


text: The Company has not had any cybersecurity risks that have materially affected the Company, including its business strategy, results of operations, or financial condition. Cybersecurity risks are disclosed in Part I Item 1A. Risk Factors, incorporated herein by reference.


text: Cybersecurity Governance Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are overseen by our Vice President and Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Director of Information Security, a direct report to the Vice President and Chief Information Officer. Our Vice President and Chief Information Officer has 27 years of technology leadership experience and a Doctor of Business Administration. Our Director of Information Security has 27 years of experience in infrastructure and security operations and a degree in Information Technology Management. Our Director of Information Security is the chair of the Company's Information Security Committee. The activities of the Information Security Committee are reviewed by the Executive Information Security Oversight Committee, which is comprised of members of our senior leadership team including our Vice President and Chief Information Officer, Senior Vice President, Chief Financial Officer, Senior Vice President, Chief Legal Officer and Secretary and Senior Vice President, Chief Human Resources Officer. The Executive Information Security Oversight Committee facilitates notification to the Audit Committee of emerging cybersecurity risks, and threats, the status of projects to strengthen the Company's information security systems, and updates on any cybersecurity incidents.


text: The Audit Committee of the Board of Directors oversees cybersecurity related risks. Members of the Audit Committee receive the above referenced notifications and updates on a quarterly basis from the Company's Chief Information Officer as the designated representative of the Executive Information Security Oversight Committee.


text: Additionally, the Company has a written Information Security Policy and a Cybersecurity Incident Response Plan that provides the above-referenced processes by which such committees are informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and material risks from cybersecurity threats.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence involves different levels of assessment designed to help identify cybersecurity risks associated with a provider. For example, we may impose contractual obligations related to cybersecurity on the provider.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Cybersecurity Risk Management and Strategy. The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with serious risks. Cybersecurity is a key risk management category within our enterprise risk management program.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk council, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.


text: Our cybersecurity risk program is a comprehensive framework designed to safeguard our organization and stakeholders from evolving threats. Central to this approach is our commitment to threat and vulnerability management, where we proactively identify, prioritize, and address potential cybersecurity gaps to strengthen our overall security posture. We emphasize identity and access management by implementing access controls and robust authentication methods to protect user identities and secure information technology systems. Data protection and privacy is in place to ensure sensitive information is protected from exfiltration. Our cybersecurity defenses leverage systems and technologies, including firewalls, network access, endpoint protection, privileged access management, user behavior analytics, multi-factor authentication, intrusion detection systems and continuous monitoring. The purpose of these systems and technologies is to stay ahead of potential threats. To prepare for and respond to potential cybersecurity events, we conduct regular incident response exercises, ensuring our readiness and resilience. Additionally, we invest in employee training and awareness programs to promote a culture of security mindfulness and reduce risks associated with human error. Recognizing the importance of third-party relationships, we maintain a vendor risk management program that includes monitoring the cybersecurity practices of our vendors, and if applicable, performing user access reviews and evaluating System and Organization Controls reports at both inception and on an ongoing basis. Together, these efforts reflect our dedication to building a secure and compliant environment that protects our operations, data, and the trust of our stakeholders.


text: Our program incorporates an Incident Response Plan to guide the evaluation, response, and escalation of cybersecurity incidents. This plan is overseen by our CIO and executed by a cross-functional Cybersecurity Incident Response Team. The incident response plan establishes clear protocols for incident identification, impact assessment, containment and resolution, with defined escalation paths based on incident severity. Cybersecurity incidents above a defined threshold of criticality are evaluated for materiality to determine reporting and disclosure requirements. To enhance our response capabilities, we conduct periodic assessments, including third-party reviews, and simulate incidents through regular tabletop exercises.


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through internal and external risk assessments and compliance audits. We regularly engage third parties to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.


text: We do not believe that risks from cybersecurity threats, individually or in the aggregate, including any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations. For additional information on how cybersecurity risk may affect our business, refer to Item 1A. Risk Factors of this Form 10-K under the heading "We rely on operating and information systems that may experience a failure, a compromise of security, or a violation of data privacy laws or regulations, which could interrupt or damage our operations and have a material adverse effect on our financial condition, liquidity or results of operations."


text: Governance. Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture. Pursuant to its charter, the Audit Committee of our Board of Directors is responsible for reviewing management's cybersecurity incident reporting process, methodology and tools. In addition, the Audit Committee is responsible for reviewing management's materiality assessments of cybersecurity incidents identified as significant by management.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. The CIO oversees a cybersecurity team, comprised of internal and external subject matter experts who work collaboratively to achieve our cybersecurity objectives. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management's strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.


text: Management is responsible for our company's day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 26 years of experience in both military and corporate leadership roles, including 13 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.


text: Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 14 years in IT leadership roles and 6 years in cybersecurity program execution and oversight of information security.


text: Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. He has 25 years of experience in IT roles including 15 years of experience in security leadership. He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker ("CEH"), and numerous vendor specific certifications.


text: As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator ("KPI") tracking, risk assessment, escalation actions, and project status.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we regularly evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Based on an assessment using these processes, we do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition. For additional information, please see the risk factor titled "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." under Item 1A., Risk factors—General risk factors, in this Annual Report on Form 10-K.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Our Board has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has 43 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.


text: Our cybersecurity team regularly updates the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.


text: In 2024, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."


text: Cyber Risk Management and Strategy We have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our Vice President, IT, who reports to our Chief Technology Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF and have accordingly certified our adherence to the respective DPF principles to the U.S. Department of Commerce with regard to the processing of personal data received from the EU, UK and Switzerland respectively. This includes compliance with the information security requirements of the DPF that prescribe that organizations creating, maintaining, using or disseminating personal data must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.


text: In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment. We have retained VeraSafe, LLC ("VeraSafe") to help review and monitor our practices and processes related to personal data and compliance with applicable data protection laws. VeraSafe acts as our Data Protection Officer pursuant to the European Union and United Kingdom General Data Protection Regulation and has served in this capacity since May 2021.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Employee Matters and Managing Growth."


text: Our Vice President, IT, who reports to the Chief Technology Officer, a member of the executive team, has over 20 years of experience managing information technology and cybersecurity matters. The Vice President, IT and the Chief Technology Officer, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") as well as International Organization for Standardization ("ISO") 27001. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: NOVANTA INC

ticker: NOVT


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies and governance processes across the risk management program. Key elements of our cybersecurity risk management program, include but are not limited, to the followings: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security processes; • cybersecurity awareness training for our employees, including incident response personnel and senior management, on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors; and • cybersecurity internal and external penetration testing.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not experienced any incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors (the "Board") recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by management on the status and development of the cybersecurity programs at each of the ESG Committee's meetings.


text: Both the Audit Committee and the ESG Committee report to the full Board regarding their activities, including those related to our cybersecurity risks and program. The full Board also receives briefings from management at least once a year on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics presented by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO").


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The CISO/CIO oversees the overall cybersecurity risk management program, and the Deputy Chief Information Security Officer ("DCISO") has the primary operational responsibilities over our cybersecurity program, including supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO, who is also our CIO, has over 23 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. The CISO/CIO holds a Master of Science degree in computer science and engineering (with a specialization in Information Assurance) and a Doctorate of Engineering Management/Systems Engineering degree. Our DCISO has served in various roles in information security for over 16 years and holds a Bachelor of Science degree in mathematics and computer science and a Master of Science degree in computer science.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW. As a professional services firm providing advice, broking and solutions in the areas of people, risk and capital, and often involving confidential and sensitive information, cybersecurity risk management is an integral part of our enterprise risk management ('ERM') strategy.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to ERM. As further described below, our cybersecurity risk management program is coordinated by cross-functional teams. Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the WTW Risk function.


text: WTW has been certified by ISO 27001 and identifies, categorizes and manages cyber risks according to frameworks such as SOC 2 - Type 2 and the National Institute of Standards and Technology ('NIST') Framework. Additionally, WTW undertakes vulnerability scanning, and engages third parties from time-to-time to conduct penetration testing to help WTW identify and reduce the threat of known and emerging cybersecurity risks.


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of cybersecurity risks to the Risk and Operational Oversight Committee (the 'Risk Committee'), which was recently formed following the completion of the three-year term of the Operational Transformation Committee. The Risk Committee assists the board of directors in its oversight of the ERM framework, policies, and practices used by WTW to identify, assess, and manage WTW's key operational risks, including without limitation: cybersecurity, technology, information security, privacy, and artificial intelligence risk. WTW's Chief Information Security Officer ('CISO') and Global Head of Technology report to the Risk Committee on cybersecurity matters, including key risks. The Risk Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 33 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the Global Head of Technology. WTW's Global Head of Technology has served in various roles in information technology for over 25 years. The Global Head of Technology holds a graduate degree in business.


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW, including enterprise risk management, operational resilience, legal, compliance and information security, coordinate to monitor, consider, and, when appropriate, address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications among these teams, the CISO, the Global Head of Technology, and other members of senior management, as appropriate, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: WTW's cybersecurity program is an ongoing process designed to identify, assess and manage WTW's risk exposures over the short-, intermediate- and long-term. Management's cybersecurity risk management strategy and processes include the following areas of focus: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective or at the level of maturity that the Company ultimately wishes to maintain. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy requires annual, mandatory privacy and information security training for all WTW colleagues. • Third-Party Risk Management: WTW's risk management strategy includes a risk management process focused on third-party service providers and other parties with which we engage that is intended to align with the technology security key controls across the organization. • Threat Intelligence: Through its regular monitoring processes, WTW obtains intelligence on cyber threats relevant to the Company at strategic, operational and tactical levels to help inform and reassess its cybersecurity risk management priorities.


text: Material Effects of Cybersecurity Incidents Although we and our vendors regularly experience cybersecurity incidents, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. We consider our enterprise information security program to be a key component of our overall risk management system, with program elements evaluated annually and briefings provided to management each quarter.

companyName: MKS INC

ticker: MKSI


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to detect cybersecurity threats and protect our information systems from these threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training, including quarterly phishing education campaigns, to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These engagements encompass a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: The information gleaned from these assessments, audits and reviews is used to enhance our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, significant findings from these assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").


text: Risks from Cybersecurity Threats We and our third-party administrators, vendors and partners are subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, these threats did not materially affect us during the year ended December 31, 2024 and we do not believe such threats are reasonably likely to materially affect us in the future, including with respect to our business strategy, results of operations, or financial condition. For more information on risks related to cybersecurity, refer to "Risk Factors—Risks Related to Cybersecurity, Data Privacy and Intellectual Property Protection."


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As set forth in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management takes to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. Our CIO and CISO report to the Audit Committee at least quarterly. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO oversees and is responsible for our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformations, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity.


text: The Company has a team of cybersecurity professionals reporting to the VP of IT, the head of the Company's cybersecurity team, dedicated to managing threats and incidents in real time and the reporting of any such incidents. The VP of IT reports to the Chief Financial and Strategy Officer. Through regular and ongoing communications, the VP of IT and the Executive Leadership Team, which includes our Chief Executive Officer, Chief Financial and Strategy Officer, and Chief Administrative and Legal Officer, manage the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate any such threats and incidents to the Audit Committee when appropriate.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: The VP of IT has served in various leadership roles in information technology and information security for over 25 years, including leading the cybersecurity programs for three public companies. The VP of IT holds undergraduate and graduate degrees in business and has attained multiple cybersecurity certifications including Certified Information Security Manager and Data Privacy.


text: We engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide annual independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for incident response, proactive threat identification services, security architecture consulting, security remediation services, patching and external audit services.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Like other large multi-national corporations, we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents. To date, there have not been any previous cybersecurity incidents that materially affected us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors - We and our business partners are dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems and data, including from cybersecurity events, our business could be adversely affected.


text: O ur VP, IT Global Infrastructure ("ITGI") leads our cybersecurity program through our global information security operations team and also leads our IT Governance, Risk and Compliance and Incident Response functions. Our acting Chief Information Security Officer ("CISO") leads our security operations functions. Our CISO has over 10 years of experience in information technology security obtained in civilian and military roles and our ITGI has over 20 years of experience in information technology and cybersecurity leadership obtained in civilian roles. As part of our cybersecurity program, our CISO and/or our Chief Information and Technology Officer regularly report on cybersecurity matters to our Audit Committee. As of December 31, 2024, our Cybersecurity, Risk and Compliance teams consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our ITGI and CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, financial loss, intellectual property theft, fraud, extortion, loss of sensitive data, harm to individuals including stockholders, violation of privacy or security laws, increased costs associated with mitigation of damages and remediation, and other legal and reputational risks. We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: SLR Investment Corp.

ticker: SLRC


text: We rely on the Investment Adviser's enterprise-wide cybersecurity program to protect our information, including due oversight of the cybersecurity programs of our key service providers and processes for the assessment, identification, and management of material risks from cybersecurity threats, including those associated with the use of third-party service providers. The Investment Adviser considers such cybersecurity threats as part of its broader risk management framework, and its cybersecurity program is designed to, among other things, protect us, insofar as is practicable, from the hazards of cybersecurity threats and vulnerabilities in accordance with applicable legal requirements and guidance. The Investment Adviser collaborates with third-party subject-matter experts, as necessary, to identify and assess material cybersecurity threat risks and evaluate and test its cybersecurity protections, including through continuous network and endpoint monitoring, employee anti-phishing training, vulnerability assessments, and penetration testing to inform the Investment Adviser's risk identification and assessment. The Investment Adviser also performs due diligence reviews on third parties that have access to our systems or data, or facilities that house such systems or data, and continually monitors cybersecurity threat risks identified through such diligence.


text: Together with management, the Board has designated an Information Security Group ("ISG") to monitor issues relating to cybersecurity and work with the Investment Adviser's third-party Information Technology ("IT") service provider to evaluate potential cyber risk vulnerabilities. While its composition may change over time, the ISG currently consists of our Chief Financial Officer and Chief Compliance Officer. The ISG, together with the Investment Adviser's third-party IT service provider, annually reviews the cyber risks applicable to our business and the measures established by the Investment Adviser and other service providers to protect against those risks and recommends changes or enhancements, as necessary. The Investment Adviser's management and the third-party IT service provider also monitor the Investment Adviser's network to identify internal and external cybersecurity threats and vulnerabilities in order to determine any steps that should be taken to protect information stored on the Investment Adviser's network and promptly inform the ISG of any identified cybersecurity threats or vulnerabilities. The ISG also makes inquiries of the Investment Adviser's management and the third-party IT service provider regarding such efforts.