text: Our Board of Directors (the "Board") maintains oversight responsibility for our ERM program. This oversight is facilitated primarily through the Risk Oversight Committee of the Board (the "Risk Committee"), which reviews the ERM program, related assessments and remediation activities for subsequent review by the Board. As part of its ERM oversight responsibilities, the Risk Committee is responsible for oversight of the Company's cybersecurity risk management, including the Company's material programs, policies and safeguards for information security, cybersecurity and data security. At least quarterly (and more frequently as required), the Risk Committee and Audit Committee meet with management, including the Chief Information Security Officer (the "CISO"), to discuss, assess and determine the allocation of resources to risk matters, including cybersecurity risks, which enables effective integration of risk practices into strategic planning and enterprise decision-making.


text: The Risk Committee works with the CISO and the Company's senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company's cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company's defenses and a cyber trend report, as well as management's progress in implementing the Company's cybersecurity strategic roadmap and compliance initiatives.

companyName: CONDUENT Inc

ticker: CNDT

secItem: Item 1C


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership.


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of its business. We do not believe that any incidents that have occurred prior to the date of this report have had or will have a material adverse effect on our business strategy, results of operations, reputation or financial position. Future cybersecurity incidents could, however, materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.


text: As a leader in business process solutions, we leverage cloud computing, AI, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases, and system software solutions. We also receive, process, transmit, and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process, and implement financial transactions and disburse funds on behalf of both commercial and government customers.


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. These processes are integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring, and management of risks.


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with the Center for Internet Security ("CIS") Critical Security Controls ("CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), and the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems, and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends, and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, and which we implement in the event of a cybersecurity incident.


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, third parties who assist with our PCI-DSS compliance assessments, and auditors who audit our systems to ensure adherence to the relevant standard under evaluation.


text: We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing, and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership. In addition, the Company has implemented an Incident Response Materiality Assessment Committee ("IRMAC"), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team ("CSIRT"). Procedures exist to ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company. New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition. In addition, future cybersecurity incidents could materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.


text: Cybersecurity Risk Management and Strategy We depend on digital technologies to perform many of our services and process and record financial and operating data. At the same time, cyber incidents, including deliberate attacks or unintentional events, have increased. To assess and manage cybersecurity risks impacting our industry and our business, we have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate vulnerabilities in our systems and related infrastructure on a regular basis and monitor and mitigate the risk of data loss and other cybersecurity threats. As part of our cybersecurity risk management program, we have a designated in-house team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents or intrusions. We have also engaged third-party consultants to conduct penetration testing and risk assessments.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks.


text: Our cybersecurity governance program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration. In addition, our cybersecurity risk management program includes processes to assess cybersecurity risks related to third-party vendors and suppliers.


text: Cybersecurity Governance Our cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. Our in-house professionals and external threat analysts possess various cybersecurity certifications, including Security +, Network +, A + and Server + certifications.


text: Our internal cybersecurity governance program is led by Mammoth's Director of Information Technology, with support from the internal information technology department, who reports to our Chief Financial Officer. Our Director of Information Technology has over six years of technological leadership experience along with an extensive background in computer support and application support. The Director of Information Technology and her team are responsible for leading cybersecurity strategy, policy, standards, architecture, and processes within our organization. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents. This team continuously identifies potential cyber vulnerabilities and opportunities for improvement, including yearly security training for all employees. This team also continuously evaluates and implements technological enhancements as part of our cybersecurity systems. Progress and developments in our cybersecurity governance program are regularly communicated to our executive team. Our board of directors, as part of its oversight process, receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that have occurred.


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1.A, Risk Factors—"We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: In addition, our internal audit function, in conjunction with third-party experts, plays a key role in reviewing and assessing our cybersecurity technologies, controls and procedures. Our security programs and measures may not prevent all incidents or intrusions and our systems and insurance coverage for protecting against cyber security risks may not be sufficient. As cybersecurity risks continue to evolve, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents or intrusions. Laws and regulations governing cybersecurity, data privacy, and the unauthorized disclosure of confidential or protected information pose increasingly complex compliance challenges, and failure to comply with these laws could result in penalties and legal liability. Our insurance coverage for cyberattacks may not be sufficient to cover all the losses we may experience as a result of such cyberattacks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks. MAMMOTH ENERGY SERVICES, INC.


text: Our internal cybersecurity governance program is led by Mammoth's Director of Information Technology, with support from the internal information technology department, who reports to our Chief Financial Officer. Our Director of Information Technology has over seven years of technological leadership experience along with an extensive background in computer support and application support. The Director of Information Technology and her team are responsible for leading cybersecurity strategy, policy, standards, architecture, and processes within our organization. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents. This team continuously identifies potential cyber vulnerabilities and opportunities for improvement, including yearly security training for all employees. This team also continuously evaluates and implements technological enhancements as part of our cybersecurity systems. Progress and developments in our cybersecurity governance program are regularly communicated to our executive team. Our board of directors, as part of its oversight process, receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that have occurred.


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. "Risk Factors--We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Risk Management and Strategy We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct tabletop exercises to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight and identification of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, recently, we have been including provisions in our supplier contracts that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. We have added these requirements in new or amended contracts going forward. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.


text: While we have experienced threats to our data and systems, to date, we are not aware that we have experienced a cybersecurity incident that had, or is reasonably likely to have, a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.


text: Our cybersecurity program is managed by our Chief Information Security Officer ("CISO"), who reports to our Chief Information and Digital Officer ("CIDO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since June 2022 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles in all areas of information technology. Our CIDO joined the Company in July 2023 with over 25 years of experience leading digital and information technology teams, including leading all aspects of her prior company's global enterprise digital roadmap, including finance, supply chain, and commercial solutions as well as data and analytics, including automation and artificial intelligence.


text: Our CISO and CIDO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIDO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.


text: Risk Management and Strategy We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct exercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.


text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight, identification, and remediation or mitigation of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify potential risk to Company systems or data. If risks are identified, we implement measures to mitigate or remediate the risk and, in cases where we cannot do so effectively, we will not grant access to our data or systems to the supplier. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.


text: While we have experienced threats to our data and systems, to date, we are not aware of a cybersecurity incident being experienced by the Company that had, or is reasonably likely to have, a material impact on our business or operations; however, because of frequently changing attack techniques and the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which we manage as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.


text: Our cybersecurity program is managed by our interim Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since March 2025 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, governance, risk, and compliance roles, secure application development and implementation roles, cyber and threat experience, and various leadership roles in several areas of information technology. Our CIO joined the Company in May 2025 with 35 years of experience in information technology roles, including implementing new information security teams on a global scale and overseeing information technology teams in multiple industries, including wholesale distribution, retail, manufacturing, finance, and information technology services, leading new global software development, and establishing global information security standards for his previous company.


text: Our CISO and CIO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.


text: As an asset manager, our business is highly dependent on information technology networks and systems. In addition, we believe that our position as an investment manager in the digital infrastructure space makes the security of these systems even more important to our Company and various stakeholders. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have not experienced any material cybersecurity incidents to date.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Cybersecurity Risk Management and Strategy DigitalBridge's risk management program is headed by its Chief Information Officer, the Vice President of Cybersecurity and the Company's Cybersecurity Architect. They possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and they leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with the senior members of DigitalBridge Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's information technology environment, provide recommendations to strengthen the program, and update us on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related to DigitalBridge portfolio companies.


text: DigitalBridge assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risk and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based on this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and are approved by the Company's Data Protection Team ("DPT"), which consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.


text: Among the risks we assess is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the DigitalBridge cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our information technology networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to ask if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design, effectiveness and tests cyber controls, and annually as part of its SOX testing, performs a review of cybersecurity audit reports for the in-scope application vendors.


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including as to cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board ("Audit Committee") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management and independent and internal auditors.


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. Any incident that the IRT determines may be material to the Company is then escalated to the DPT, which is responsible for overseeing the investigation of and response to such incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that any notification and regulatory filings are made in a timely manner.


text: As an investment manager, our business is highly dependent on information technology networks and systems. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024, we have not experienced any material incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.


text: Cybersecurity Risk Management and Strategy The Company's risk management program is headed by its Chief Information Officer, Vice President of Cybersecurity and its Cybersecurity Architect. Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with senior members of the Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's IT environment, provide recommendations to strengthen the program, and provide updates on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related the portfolio companies of our funds.


text: The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based upon this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and approved by the Company's Data Protection Team ("DPT"). The DPT consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.


text: Among the risks assessed is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our IT networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to determine if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (" Audit Committee ") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management, internal auditors and independent auditors.


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. When the IRT determines a cybersecurity is significant, it is escalated to the DPT, who is responsible for overseeing the investigation of and response to such cybersecurity incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that notification and regulatory filings are made in a timely manner.


text: Our cybersecurity risk management program includes: • physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: Coinbase Global, Inc.

ticker: COIN


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Audit Committee has established the Enterprise Risk Management Working Group ("ERMWG"), comprising members of our senior management team and other senior leaders, to provide executive oversight of our enterprise risk management program. Our Chief Security Officer ("CSO") is a member of the ERMWG, and together with our Chief Information Security Officer ("CISO") leads an ERMWG sub-working group related to cybersecurity, which meets periodically to review and discuss emerging and key risks relating to cybersecurity at the company, and to provide regular updates to the ERMWG.


text: The Audit Committee receives updates from the ERMWG and from members of management, including our CSO and CISO, on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly basis or more frequently as needed. The board of directors also receives updates from our CSO and CISO on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our board of directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our CSO and CISO as part of the continuing education of our board of directors on topics that impact public companies. Finally, our board of directors annually reviews and is required to approve our Global Information Security Program Policy and any changes recommended by our CSO.


text: Our management team, including our CSO and CISO, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our CSO's and CISO's experience includes years of working in the cybersecurity field in various industries, including the financial services industry.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including through periodic ERMWG sub-working group meetings; briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: ACM Research, Inc.

ticker: ACMR


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our financial performance and results of operations, under the heading "Breaches of our cybersecurity systems could degrade our ability to conduct our business operations and deliver products to our customers, result in data losses and the theft of our intellectual property, damage our reputation, and require us to incur significant additional costs to maintain the security of our networks and data" in Item 1A, "Risk Factors" of Part I of this report.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive reports of any breaches or developments regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Audit Committee and Board members may also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Key individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report directly or indirectly to the Audit Committee on any appropriate items.


text: We have established an Information Security Management System (the "ISMS"), which is integrated into our overall risk management system, to help us achieve our business goals. The ISMS defines our information security risk management approach and specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a risk assessment framework within the context of our overall business risks. The ISMS also specifies the requirements for implementing security controls designed to meet the needs of individual departments or parts thereof.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: Risk Management and Strategy Our cybersecurity strategy focuses on implementing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have processes in place designed to assess, identify, manage, and address material cybersecurity threats and incidents, including: annual security awareness training for employees, mechanisms designed to detect and monitor unusual network activity, and containment and incident response tools. Our ISMS is designed to help us identify and manage material risks from cybersecurity threats, and as part of our ISMS, we engage a range of third-party service providers, including assessors, consultants, and auditors, to assist us in these processes. Our risk assessment framework involves an information security risk assessment procedure that helps us identify potential cybersecurity threats and vulnerabilities (including relating to the use of third-party service providers) and then determine strategies to mitigate or counter the threats. As part of this process, we conduct annual penetration testing utilizing a third-party service provider. We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Our Information Technology Director also works with third-party service providers to assess potential cybersecurity threats and determines risk scores based on the likelihood of threats and the potential impacts of the threats, prioritizes risk and determines and recommends to our management controls aimed to counter such threats. We assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.


text: We also maintain procedures designed to protect the security of personally identifiable information, and our Privacy Policy provides details regarding the collection, storage, usage, and destruction of data. We require all employees to engage in data-security training upon hire and receive ongoing training thereafter. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director is part of the Company's Security Committee and reports to the Security Committee with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Security Committee, comprised of the Information Technology Director, the Chief Financial Officer, the Chief Legal Counsel and the Vice President of Human Resources is ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, our Security Committee holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. The Security Committee has experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee reports to the Board.


text: Impact of Risks from Cybersecurity Threats As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Part I, "Item 1A. Risk Factors" of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director reports to the audit committee of our Board with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Information Technology Director and our Chief Financial Officer are ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, they hold discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. They have experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee provides relevant updates to the Board.


text: Cybersecurity Risk Management and Strategy The Company assesses, identifies, and manages cybersecurity risks using a risk management program intended to reduce risks to the Company, its employees, customers and stockholders.

companyName: HF Foods Group Inc.

ticker: HFFG


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment procedures. Our cybersecurity-specific risk assessment and management procedures help identify cybersecurity threat risks. Our cybersecurity risk assessment program includes the following: • Annual cybersecurity vulnerability and maturity assessments based on the Center for Internet Security (CIS) Critical Security Controls framework. • Annual internal/external penetration testing conducted by a third-party offensive security vendor.


text: A significant cybersecurity incident may result from actions by our employees, suppliers, third-party administrators, or unknown third parties or through cyber-attacks and could affect our data framework or cause a failure to protect the personal information of our customers, suppliers or employees, or sensitive and confidential information regarding our business and could give rise to legal liability and regulatory action under data protection and privacy laws. The Company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the Company under the heading "We rely on technology in our business and any cybersecurity incident, other technology disruption or delay in implementing new technology could negatively affect our business and our relationships with customers," in Item 1A of this Annual Report on Form 10-K. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its financial condition, results of operations, or business strategies.


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by a dedicated Head of Information Technology, who has over twenty years of experience in IT application management, infrastructure and security across a variety of industries including Financial Services, Defense Contracting, Manufacturing and Distribution, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Head of Information Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, key updates to our information security systems and programs as well as the current threat environment.


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by our Senior Vice President of People and Technology, who has twenty-five years of experience in IT leadership across a variety of industries including manufacturing, distribution, defense, and financial services, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Senior Vice President of People and Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, and key updates to our information security systems and programs as well as the current threat environment.


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including: • Any cybersecurity breach, unauthorized access, data loss, or ransomware attack must be immediately escalated to the Disclosure Committee, General Counsel, Internal Audit, and Audit Committee. • On a quarterly basis, the Disclosure Committee, in coordination with the SVP of People and Technology, Internal Audit, and vCISO, shall assess the Company's cybersecurity risk exposure, including potential vulnerabilities in IT systems and data security.


text: We design and assess our information security program with reference to the ISO 27001:2022 standard. For interoperability, our controls leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO 27001:2022 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TechnipFMC plc

ticker: FTI


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board receives regular updates from the Audit Committee on cybersecurity risks, often with the participation of the Chief Information Security Officer ("CISO") to report on our information security activities. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.


text: Our ISSC assists our management team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers, or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer, and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.


text: Cybersecurity Risk Management and Strategy We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: Varex Imaging Corp

ticker: VREX


text: To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the Cyber Security Framework of the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") Critical Security Controls. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including information security policies and procedures, simulation exercises, network and endpoint monitoring and detection tools, vulnerability management processes, risk assessments, third-party penetration testing and security requirements for our suppliers, vendors, and service providers. We have also engaged third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support, and to provide periodic independent assessments and evaluations of our cybersecurity program, including through table top exercises to simulate responses to cybersecurity incidents, and other professional services.


text: We also monitor and test our safeguards and train our employees on cybersecurity safeguards related to our information technology systems. Our employees are required to take periodic training on cybersecurity and data privacy, and we conduct regular phishing email simulations to enhance awareness and responsiveness to such possible threats. We carry information security risk insurance that provides protection against certain defined potential losses arising from a cybersecurity incident.


text: In the event of a suspected incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the head of our Information Technology department ("Head of IT") and functional areas (e.g., legal and human resources) as appropriate. This includes processes for assessing such incidents for materiality, making required notifications, disclosures or communications and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A, "Risk Factors" in this Annual Report, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity strategy, programs, and risk mitigation activities, as well as other developments and action items related to cybersecurity. In its meetings, the Audit Committee has the opportunity to discuss these matters with the head of our Information Technology department and other members of executive management. Members of the Board are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 39 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organizations.


text: Cybersecurity Risk Management and Strategy We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources to cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our Information Technology team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 40 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organization s.


text: Cyber Risk Management and Strategy Our cybersecurity organization's mission is to provide a targeted set of services, support and capabilities to reduce the risk of cyberattacks, rapidly detect and contain threats, and mitigate risks to critical data.

companyName: Moderna, Inc.

ticker: MRNA


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO) and Chief Information Officer (CIO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.


text: Management has established a cyber incident response plan (CIRP) designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.


text: We undergo several annual internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. In an effort to minimize third-party risk, we have established a process to assess the security practices of third-party suppliers and related risks, including through review of relevant supplier certifications and security and responses to standardized information gathering (SIG) questionnaires, as applicable and appropriate.


text: Governance Related to Cybersecurity Risks Our Board of Directors oversees Moderna's overall risk management strategy. The Board exercises oversight of risks from cybersecurity threats primarily through its Audit Committee, which oversees our risk management processes for information security and technology risks. Our cybersecurity risk management processes are integrated into our overall risk management strategy, which is overseen by the Audit Committee. At least annually, the Audit Committee discusses our risk management program, including information security and technology risks and findings from any audits, with our internal audit staff.


text: The Audit Committee receives cyber-related updates from management, including our CISO at committee meetings. During meetings, our CISO updates the committee on Moderna's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our CIO, who is a member of our Executive Committee and reports to our Chief Executive Officer.


text: We have built a cybersecurity leadership team designed to align with key services, with a separate lead overseeing each service offering, all reporting to the CISO. We also maintain relationships with law enforcement and industry groups to support our cybersecurity intelligence and risk management efforts.


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our Chief People and Digital Technology Officer, who is a member of our Executive Committee and reports to our Chief Executive Officer.


text: As part of our information technology needs, we have contracted with National Beef to provide certain equipment and services related to telephone systems, servers, network access, desktop and end-user support, and back-office equipment support. Inherent in the services provided by National Beef are its efforts to assess, identify and manage risks from cybersecurity threats related to the specific equipment and services it provides us. We have no independent internal processes for addressing cybersecurity threats and have not integrated any processes provided by National Beef in assessing, identifying and managing risks from cybersecurity threats into our overall risk management system; however, we do receive monthly reports from National Beef on user access changes to our electronic accounting file share folder.

companyName: U. S. Premium Beef, LLC


text: We are not aware of any risks from cybersecurity threats or previous cybersecurity incidents (and we are not aware of any) that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: The Board of Directors oversight of risks from cybersecurity threats has been limited to authorizing the engagement of National Beef to provide the information technology equipment and services described above. Management's role in assessing and managing our risks from cybersecurity risks has similarly been limited to the engagement of National Beef to provide information technology equipment and services. If National Beef were to inform us of a cybersecurity incident, that incident would be reported to the Board of Directors if material in nature.


text: Risk Management and Strategy Our information security policies and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security and confidentiality of consumer information. We use various tools and strategies to identify and assess material risks from cybersecurity threats. We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing. The cybersecurity risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security of our information systems.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: We also actively monitor our systems and connections for abnormal activity, including malicious phishing attempts. This includes the use of intrusion detection systems, log analysis, and real-time monitoring of critical systems. We have an incident reporting portal available to all employees to submit any issues they suspect may pose a risk to our information technology ("IT") systems and security.


text: We use the results of the above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity threats, to enhance such safeguards, or implement new safeguards, as necessary. We have several safeguards in place to manage material risks from cybersecurity threats. We have security awareness training for our employees, including ongoing simulated phishing email campaigns. We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access to our systems, password security, and two-factor authentication. We continuously update our software and security patches. We restrict inbound email attachments, certain websites, and cloud-based drives. We monitor and restrict information transfers to and from unauthorized IP addresses. We also have physical security safeguards for our locations and data centers. We back up our systems and data regularly. In addition, we have a disaster recovery program designed to help us quickly respond to and recover from an interruption of critical IT services.


text: As part of our overall risk management processes, we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments as needed, including IT, Systems, Risk Management, and Legal. We engage assessors, consultants, auditors, or other third parties to assist with some of the processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability testing, and penetration testing. To oversee and identify material cybersecurity risks associated with our use of third-party service providers, we limit data access for third-party service providers to only the data that is necessary for the given function and conduct due diligence on our service providers including their information security practices. We require our service providers to maintain appropriate safeguards for the security of consumer information.


text: We cannot assure that our information security policies and processes will be effective in protecting us from cybersecurity threats. Risks from cybersecurity threats have not materially affected us. However, if we experience a material cybersecurity incident it is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information, please see Item 1A. Risk Factors of this Report, including the risk factors titled "If We Experience Problems with Our Originations, Accounting or Collection Systems, Our Results of Operations May Be Impaired" and "A Breach in the Security of Our Systems Could Result in the Disclosure of Confidential Information, or Subject us to Liability."


text: The Senior Vice President of Systems and the Vice President of IT are responsible for assessing and managing material risks from cybersecurity threats through the implementation of the Company's information security policies and processes. The Senior Vice President of Systems has over 20 years in IT and cybersecurity experience with the Company. The Vice of President IT has over 15 years in IT and cybersecurity experience with the Company and has earned industry certifications in IT. The Senior Vice President of Systems and the Vice President of IT report to the Executive Vice President of Risk, Systems, and IT.


text: The Senior Vice President of Systems and the Vice President of IT work directly with the internal and external IT personnel to implement our information security policies and processes, including those described in the "Risk Management and Strategy" above. They are informed about and monitor the prevention, detection, mitigation, and remediation or prevention of cybersecurity incidents through those processes. They regularly report on the status of these matters to the Executive Vice President of Risk, Systems, and IT.


text: The Board, as a whole, is responsible for risk oversight, including cybersecurity risk. As part of this oversight, the Executive Vice President of Risk, Systems, and IT reports to the Board annually on the status of and developments in the Company's information security policies and processes.


text: Management and Strategy Our cybersecurity program is designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader risk management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, we utilize a combination of internal technology and a third-party managed security service provider and their platform to monitor, evaluate and respond to cyber activity. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security approach, and make the necessary changes to address such findings.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: Board of Directors Our Board of Directors oversees our risk management process, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit and Corporate Governance Committee. The Chief Financial Officer presents updates to the Audit and Corporate Governance Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape.


text: Our Chief Financial Officer is responsible for management oversight of our information security program and controls, which includes cybersecurity risk management. Our Director of IT ("Director") is responsible for the development, operation, and maintenance of our information security program and controls.


text: The Director has over 18 years of experience in the information technology field, and cybersecurity knowledge and skills gained through relevant experiences. The Director and Chief Financial Officer regularly review potential risks and measures implemented by the Company to identify and mitigate cyber security risks.


text: Risk management and strategy We, through our third-party provider that manages our information technology systems and networks, maintain policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Financial Officer, who manages the Company's overall risk assessment and mitigation process. In addition to monitoring cybersecurity threats to the Company's information systems, the Company's risk management practices are intended to help monitor, mitigate and prevent cybersecurity risks from external sources. We operate as a virtual company and maintain vital information, including financial and payroll information, on servers owned and maintained by our vendors. As such, we rely on the internal controls of our third party vendors to protect our vital information. We obtain and review reports on the internal controls of our vendors on an annual basis to ensure that we believe their cybersecurity procedures are adequate and to confirm that there have been no data breaches affecting our information.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO