text: Key features of the program include: • Implementation of a detailed cyber incident response plan that provides controls and procedures for identifying, assessing, containing, remediating, escalating, and reporting cyber incidents. • Cross-functional approach to addressing cybersecurity risk, with engagement among internal working groups such as Risk, Information Technology, Operations, Procurement, Legal, Compliance, and Internal Audit functions. • Information security policies and procedures that are reviewed at least annually and updated to reflect changes in law, technology, practice, and emerging threats. • Cybersecurity awareness training for employees, upon hire and at least annually thereafter; • Ongoing monitoring, and periodic assessment and testing, of our networks and systems for threats, vulnerabilities, and other cybersecurity risks, internal and external. • Periodic tabletop exercises and response readiness assessments, with participation from senior executives, led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness; results are provided to the audit committee. • Development of risk mitigation strategies that may defray costs associated with an information security breach. • Periodic cyber drills and disaster recovery tests which are designed to help ensure our business operations can continue in the event of a cybersecurity attack. • Comprehensive internal risk assessment of critical third-party service providers, including of their cybersecurity posture prior to onboarding; contractual requirements for critical third-party service providers to adhere to our standards and incidents reporting; once engaged, critical third-party service providers are required to maintain a comprehensive cybersecurity plan in conformity with industry standards. We engage industry specialists and other third parties in connection with such processes.


text: Our information security program is managed by our Chief Information Security Officer (CISO) with collaboration across lines of businesses and corporate functions. The CISO is a senior-level executive responsible for establishing and executing our information security strategy, including cybersecurity oversight. The CISO reports directly to our Chief Information Officer (CIO), who reports directly to our Chief Operating Officer (COO). The CIO and CISO are members of the management operational risk committee, which reports to the management risk committee. The COO is a member of the management risk committee, which reports to the board risk committee. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Committees of the Board of Directors—Management Committees for additional information about the management operational risk committee, which is responsible for overseeing operational risk, including cybersecurity risk, and the management risk committee, which is responsible for overseeing overall corporate risk.

companyName: Athene Holding Ltd.

ticker: ATH-PA

secItem: Item 1C


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. As of February 1, 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CIO is responsible for managing our information technology strategy. Our CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies; and received a Bachelor of Science in business management and a Master of Business Administration in management information systems.


text: The CISO is responsible for managing our information security program. Our CISO has over 20 years of information technology experience and over 15 years of information security experience; is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CISO is responsible for managing our information security program. Our CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager, and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: Risk management and strategy We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard our company's networks and digital assets and maintain the integrity of our operations.

companyName: Vital Energy, Inc.

ticker: VTLE


text: We have a robust cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.


text: In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises to refine and update incident response processes. We have a management-level Breach Disclosure Committee, which is a subcommittee of our Disclosure Committee and includes our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") that is responsible for assessing and identifying material risk from cybersecurity threats. In the event of a cybersecurity incident, the Breach Disclosure Committee is responsible for making recommendations to the General Counsel regarding the materiality of the incident based on documented guidelines for assessing risk.


text: We engage third-party vendors, assessors, consultants, auditors, and other third-party service providers. We recognize that third-party service providers introduce risk from cybersecurity threats. In an effort to mitigate these risks, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require third-party service providers to adhere to certain security standards and protocols.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Risks from cybersecurity threats are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of directors' oversight and management's role Our board of directors has primary oversight of risks from cybersecurity threats. The board of directors delegates oversight of our enterprise risk management process with respect to material risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for reviewing and discussing with management the Company's risk from cybersecurity threats and the security of the Company's data and information technology systems, reviewing management's cybersecurity strategy, as well as the implementation of cybersecurity policies, procedures and strategies. Additionally, on a periodic basis, management reviews results from assessments of key risks with the Audit Committee and the steps taken to mitigate new risks which have been identified.


text: The CISO briefs the Audit Committee on cybersecurity matters at each quarterly meeting, and annually meets with the Audit Committee in executive session to report on cybersecurity matters. In addition, cybersecurity training on the current cybersecurity landscape and emerging threats is provided to the board of directors.


text: Our CTO and CISO meet regularly to assess current cybersecurity threats and evaluate our potential vulnerability to cybersecurity risks. The CTO and CISO also engage periodically with external and internal auditors and engage periodically with the guidance of outside threat intelligent agencies including the Cybersecurity and Infrastructure Security Agency and the Oil and Natural Gas Information Sharing and Analysis Center.


text: With oversight from the CTO, the CISO is responsible for assessing and managing cybersecurity risks. With over 30 years of IT management experience, the CISO has over 15 years experience in developing, leading and managing cybersecurity programs. The CISO holds Bachelor's degree in Management Science and Computer Systems along with a Certification in Cybersecurity Oversight through the National Association of Corporate Directors ("NACD") and the Software Engineering Institute of Carnegie Mellon University.


text: Risk management and strategy We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard the Company's networks and digital assets and maintain the integrity of our operations.


text: We have a comprehensive cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital Energy engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity threats, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, client data and patient data, or, collectively, Information Systems and Data.

companyName: NeuroPace Inc

ticker: NPCE


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Vice President, Manufacturing and Commercial Operations and Information Technology. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our Privacy and Security Officer works with Information Technology, Legal, and other NeuroPace leadership to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity service provider, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires for certain vendors, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and sixteen years as a corporate privacy and security officer, as well as our Vice President, Manufacturing and Commercial Operations and Information Technology.


text: Our Privacy and Security Officer, Director of Information Technology, and NeuroPace leadership are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Privacy and Security Officer in coordination with our Director of Information Technology is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Vice President, Manufacturing and Commercial Operations and Information Technology and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from our Privacy and Security Officer concerning significant cybersecurity threats to us and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Chief of Operations and Development, as well as our engineering operations and third-party service providers. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, phishing simulation exercises, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires and risk assessments for certain vendors, vulnerability scans for certain vendors, security assessment calls with certain vendor's security personnel, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the section titled "Risks related to privacy, information technology and cybersecurity" located in Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and seventeen years as a corporate privacy and security officer.


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Chief of Operations and Development and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Our products involve the collection, storage and processing of customer data (including, in some cases, personal data), and may provide business critical software and analytics necessary for our customers' operations. Guidewire develops, implements, and maintains cybersecurity measures designed to safeguard our products and protect the confidentiality, integrity, and availability of our customer data and our confidential information.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems, information, and products. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We maintain various internationally recognized security certifications and aim to adopt best practices from industry-leading frameworks and standards for cybersecurity and cloud computing, including, without limitation, ISO 27001 certification, SOC 2, U.S. NIST Cybersecurity Framework (CSF), and the CIS Critical Security Controls. This does not imply that we have met any particular technical standards, specifications, or requirements, only that we use these frameworks, industry best practices, and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and our broader enterprise IT environment; • an enterprise-wide security team principally responsible for managing our cybersecurity risk assessment processes, implementing and maintaining our security controls, and responding to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, product development personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, including, among others, vetting, periodic monitoring, and the implementation of contractual safeguards to ensure adherence to our cybersecurity standards.


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Our Board, by way of our Risk Committee, oversees management of cybersecurity and other information technology risks. The Risk Committee receives periodic reports from management on our cybersecurity risks and control structure. In addition, management updates the Risk Committee, as necessary, regarding cybersecurity incidents.


text: The Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive reports on cybersecurity risks from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has over 20 years of experience in the technology sector, including 18 years dedicated to information security. He has held multiple executive security roles in a large Fortune 500 company, overseeing product security, mergers and acquisitions security, marketplace security, and enterprise security. He holds a Bachelor of Science in Information Systems Management and a Masters of Business Administration.


text: Our management team will periodically receive information on our cybersecurity program designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include periodic briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity incidents or breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is based on principles set forth in the Secure Controls Framework (SCF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the SCF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.


text: Our cybersecurity risk management program is a key component of our overall process concerning assessment and management of enterprise risk. Risks relating to cybersecurity, data privacy and other information technology risks are overseen by the Information Systems Audit Committee of the Board (the "IS Audit Committee"), and the assessment and management of other enterprise-level risks are overseen by the Audit Committee of the Board.


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients' customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the IS Audit Committee oversight of cybersecurity, data privacy and other information technology risks. The IS Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The IS Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the IS Audit Committee, as necessary, regarding significant cybersecurity incidents.


text: The IS Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO") on our cybersecurity risk management program. Directors receive presentations on cybersecurity topics from our CISO as part of the board of directors' continuing education.


text: Our management team, including our CISO and CCO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO's experience includes over 25 years of helping to build global cybersecurity programs in companies ranging from Fortune 50 to early stage entities. Our CCO, who is responsible for our technology risk management program, has over 25 years of experience building and leading risk management and compliance programs in large institutions across multiple geographies.


text: Our management team, led by our CISO and CCO, stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Although our CISO resigned in January of 2025, we have elevated an internal candidate to the role of interim CISO while we search for a replacement. As designed, our CISO and CCO are members of the management team and are primarily responsible for assessing and managing our material risks from cybersecurity threats, as well as our overall cybersecurity risk management program. As designed, our CISO is responsible for supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our interim CISO's experience includes over 20 years of helping to build global cybersecurity programs in various industries. Our CCO, who is responsible for our technology risk management program, has over 25 years of experience building and leading risk management and compliance programs in large institutions across multiple geographies.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our information technology ("IT") personnel, together with third party firms, continuously work to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, [including the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443]. Our executive management team and Board of Directors are periodically updated regarding the status of, and adjustments to, our cybersecurity program.

companyName: Smart Sand, Inc.

ticker: SND


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent,identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the VP of Technology and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. The VP of Technology is also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our VP of Technology provides our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Our VP of Technology leads all components of our IT functions. Our VP of Technology has over 29 years of experience in the IT profession, including 7 years with Smart Sand.


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under General Risk factors in Item1(a) Risk Factors.


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the designated IT personnel and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. Designated IT personnel are also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our IT personnel regularly provide our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Our CFO leads the IT department and together with IT management they have more than 30 years of combined experience in the IT profession.


text: Risk Management and Strategy We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place an enterprise risk management (ERM) program designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our ERM process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.

companyName: Capri Holdings Ltd

ticker: CPRI


text: We understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. We communicate our brands' data collection, use and processing practices through clear and comprehensive privacy notices. We empower our data subjects to exercise their privacy rights by contacting us through various channels, and we maintain procedures to honor their requests made pursuant to applicable laws. We continually evaluate our privacy notices, policies and procedures surrounding our handling of personal data and the measures and systems we have in place to help identify, assess, mitigate, respond to and remediate cybersecurity issues or personal data breaches.


text: The key steps we have taken to detect, identify, classify and mitigate cybersecurity and privacy risks, include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures and undergoing cyber-incident table top exercises; • Using network and system security tools aimed at detecting and mitigating unauthorized system and data access and cyber threats; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Utilizing threat intelligence to assess potential impacts to company systems and mitigating risks, when applicable, through preventive measures including updates and patching; • Conducting cyber-maturity evaluations, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a periodic basis; • Assessing cybersecurity risk profiles of our third-party service providers, including by partnering with key providers to ensure they have appropriate security measures to safeguard their information technology systems and including robust data security provisions in our contracts with third parties that handle our data; • Providing annual security and privacy training and awareness to our employees to educate our employees on cybersecurity risks; and • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training.


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A "Risk Factors—Risks Related to Information Technology and Data Security—Privacy breaches and other cyber security risks related to our business could negatively affect our reputation, credibility and business."


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our ERM process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for operation of the ERM program and risk management, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from either our Chief Information Officer (CIO) or our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who reports to our CIO, and who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.


text: Our Head of Cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO and General Counsel of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Subsequent to the end of our fiscal year, our CIO left the Company and, in the interim, our Head of Cybersecurity currently reports to our CFO who reports to our Chief Executive Officer.


text: Risk Management and Strategy We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place a group-wide risk management process designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our risk assessment process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A Risk Factors - "Risks Related to Information Technology and Data Security."


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our risk assessment process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary oversight of management's enterprise risk assessment and risk management policies and practices, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Our Head of Cybersecurity reports to our CFO who reports to our Chief Executive Officer.


text: Risk Management and Strategy As part of our overall risk management system we maintain comprehensive policies and processes for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to production, safety, reputation, intellectual property, procurement and business continuity. Cybersecurity risk management is included as part of our overall annual Enterprise Risk Management program. As part of this program, our enterprise risk professionals consult with internal cybersecurity subject matter experts to identify cyber risks and evaluate their severity and the efficacy of our mitigation efforts, with the results being reported to the executive leadership team and the Board of Directors.

companyName: Tronox Holdings plc

ticker: TROX


text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, next generation firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements.


text: Our cybersecurity risk management policies and processes extend to cyber risks posed by our third-party service providers. To manage that risk we have implemented a process to identify critical vendors and perform a reasonable level of due diligence on the adequacy of their cybersecurity policies, processes and capabilities.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Like most major corporations we have been the target of cyberattacks from time to time and we expect to be the target of such attacks in the future. In the past three years, however, we have not experienced a material information security breach. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from fines, penalties or settlements related to a cybersecurity breach. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our entire Board of Directors provides oversight of the Company's cybersecurity policies, processes and capabilities as part of their overall oversight of risk management. Once a year, our Vice President, Cyber Security reports to the Audit Committee providing a detailed update on the threat landscape, emerging trends and the Company's mitigation efforts. This report also includes Tronox's performance as measured by the NIST Cybersecurity Framework Scorecard. As needed on a periodic basis, our Vice President, Cyber Security updates the Audit Committee on specific cybersecurity events and newly emerging risks and the actions taken by the Company in response to those events and risks. The Audit Committee updates the full board on these matters as necessary. The full Board reviews and assesses cybersecurity risks in connection with its annual Enterprise Risk Management review.


text: In 2020, Tronox established an IT Security Council to help set corporate risk tolerance and related policy. The council meets quarterly, is chaired by the General Counsel and managed by our Vice President, Cyber Security with senior level representation from key functions and business units. On an annual basis, the Tronox Cybersecurity team reviews and updates the core governance documents, including the Acceptable Use Policy, the Information Security Policy, and the Incident Response Plan. These are then subject to review and approval by the Tronox Security Council with a summary provided to the Audit Committee as a component of the annual cybersecurity Enterprise Risk Management.


text: Day to day cybersecurity risk oversight governance is the responsibility of our Vice President, Cyber Security who has been with Tronox since 2017 and reports to our Senior Vice President, Integrated Supply Chain and Digital Transformation. Tronox's Vice President, Cyber Security has over 30 years of IT experience, 20 years of security experience and was awarded a Member of the British Empire honor with respect to his work in the field. Previous roles include Interim Chief Information Security Office for Pacnet (Hong Kong) and Director of Security for Level 3 Communications along with multiple engagements for the UK government. He oversees a dedicated security team distributed globally with more than 15 members and over 100 years of aggregate cyber security experience.


text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements. • Membership in a United Kingdom industry cybersecurity group to facilitate intelligence sharing and develop incident response capabilities. • Utilizing a third party vendor for detect and response services who provides 24x7 monitoring and incident response capabilities across the various Tronox technology platforms.


text: Given our decentralized and adaptive operating model, each of our businesses is responsible for implementing and managing its own cybersecurity program, following our established enterprise-wide standards and strategy and using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which outlines industry-wide best practices addressing the components of a cybersecurity program. We utilize a third party to routinely assess the alignment of the cybersecurity programs across our organization with the NIST CSF and the program maturity in each of the included objectives. The results of these assessments are used to develop a risk-informed approach to our prioritization and allocation of resources and investment.

companyName: Post Holdings, Inc.

ticker: POST


text: We employ industry standard security controls and technologies to protect our information technology ("IT") environment and to monitor for and detect anomalous activity. Our IT security controls and technologies are designed to protect the confidentiality, integrity and availability of our processes and systems. Across our organization, our IT security architecture and controls are designed using a risk-based approach that takes into account the effectiveness of the controls, the likelihood and severity of the risk, the current threat landscape, known industry-specific threats and the likely impact of a breach with and without the respective controls. Our controls and technologies are evaluated regularly for their relevancy to the current threat landscape. We retain a risk register to catalog known risks and assess their potential impact on our organization, enabling our proactive management of such risks and the development and implementation of mitigation strategies. We also utilize independent third parties to perform annual penetration tests at each of our businesses, allowing us to internally and externally test the controls in our facilities, networks, devices and cloud environments. In addition, we maintain and test backup and recovery systems and disaster recovery of our critical systems that are required to support our core business operations.


text: Our Company depends on third-party technology providers that are critical to our business operations through software, services, solutions and hosting. We utilize programs to assess the controls of these providers in an effort to reduce the likelihood of potential impacts to the confidentiality, integrity and availability of our systems. We also design our systems and the ways such providers may access our systems to limit their ability to impact our operations or systems beyond what they require. In addition, for third parties that may hold our information on their own systems, we implement processes to gather information about how such third parties secure their systems, which may include obtaining and reviewing attestations and reports from the third parties.


text: To help raise employee awareness of current cybersecurity threats and tactics, in particular social engineering, we provide training to our employees so that they can help identify risks and protect our organization. Through annual training, monthly phishing simulation tests, newsletters and other information postings, we educate our employees and reinforce our processes to report any suspicious activity.


text: In the event of a cybersecurity incident, our businesses maintain incident response plans meeting certain enterprise-established standards. Such incident response plans address the roles and responsibilities of personnel across our enterprise, required steps to take in response to an incident, incident communications plans, designated contacts for outlined response activities and playbooks to guide responses to certain common types of threats that we face. These incident response plans are reviewed and updated at least annually, with table-top exercises performed at least annually. We also have established relationships with various third-party experts and advisors to provide support in the event of a cybersecurity incident. In addition, we maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents. In conjunction with our incident response plans, we also have a process to assess whether a cybersecurity incident triggers applicable regulatory reporting obligations.


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Risk Factors – Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2024, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.


text: Various individuals and teams throughout our organization are responsible for the oversight and management of cybersecurity risk for our organization.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity risk. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends and cybersecurity events.


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty-two years of IT experience, including eight years of experience dedicated to cybersecurity and IT risk management. Having spent over twelve years at Post in various IT capacities, including approximately four years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses approximately twenty-six years of IT experience, including approximately six years of cybersecurity and risk management oversight, and approximately six years in supply chain and business transformation leadership. This includes over thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.


text: Our Security Council, comprised of the Security Leads from each business and led by our CISO, meets on a monthly basis to discuss emerging trends and threats, share cybersecurity practices across our organization and discuss potential issues. Our Enterprise Security Risk Group (the "ESRG"), which is comprised of a cross functional group of leaders from our organization representing legal, finance, human resources, compliance and internal audit and is led by the CISO, meets at least quarterly to review cybersecurity program performance, cybersecurity risks, progress on projects and risk remediation activities. In addition, the Security Leads report on their cybersecurity programs to the CISO and the ESRG on a quarterly basis.


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" within "Risk Factors" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2025, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity and other technology risks. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends, including regarding AI, and cybersecurity events.


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty years of IT experience, including significant experience dedicated to cybersecurity and IT risk management. Having been with Post in various IT capacities since 2012, including approximately five years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses over twenty-five years of IT experience, including many years of cybersecurity and risk management oversight, and numerous years of experience in supply chain and business transformation leadership. This experience includes approximately thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we collect and store personal information and other sensitive information on our information systems. To protect our information, our existing cybersecurity policies require continuous monitoring and detection programs and network security precautions.

companyName: Inari Medical, Inc.


text: Our cybersecurity processes, technologies, and controls aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks and reputational risks.


text: Our enterprise risk management program incorporates risks related to cybersecurity threats alongside other company risks as part of our overall risk assessment process. We also employ a cybersecurity-specific risk assessment process. Our IT professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals of risk identification and assessment. We also engage experts to attempt to infiltrate our information systems.


text: Additionally, we undertake the following activities as part of our processes to assess, identify and manage material risks from cybersecurity threats: • monitor emerging data protection laws and implement changes to our processes as needed; • conduct periodic cybersecurity management and incident training as well as social engineering training for employees and consultants involved in our systems and processes that handle sensitive data; • require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • perform tabletop exercises to simulate a response to a cybersecurity incident and use the findings to inform our processes and technologies; and • leverage the NIST incident handling framework to help us respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance to provide protection against certain potential losses arising from a cybersecurity incident.


text: We also maintain an incident response plan, which outlines our procedures for detecting, responding to and recovering from cybersecurity incidents. The incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate the cybersecurity threats and incidents, as well as to assist in complying with potentially applicable legal obligations and mitigating brand and reputational damage.


text: As part of the above processes, we engage with assessors, consultants, auditors, and other third-parties to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: We are continuing to build processes to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. Additionally, we generally require those third parties that have greater access to sensitive information to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We do not believe risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to the risk factor titled "Failure to protect our information technology infrastructure against cyberattacks, security breaches, service interruptions, or data corruption could materially disrupt our operations and adversely affect our business and operating results", included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, for additional information about risks related to cybersecurity matters.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are overseen by our cybersecurity committee, which is led by our Vice President, IT and is comprised of a cross-functional team which includes our Chief Financial Officer and General Counsel, along with other members of our IT, legal, finance and internal audit departments. To facilitate our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Our cybersecurity committee meets on a regular basis and is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Through ongoing communications with these teams, our Vice President, IT, and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the audit committee on a quarterly basis and as otherwise necessary, and annually to the full Board and as the cybersecurity committee otherwise deems appropriate. Our Vice President, IT has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing data centers, designing networks and infrastructure. Our Vice President of IT oversees a team of experienced and certified individuals who holds various certificates relevant to information security.


text: The audit committee of our board of directors has oversight responsibility for our data security practices and cybersecurity threats, periodically reviewing and discussing with management our policies, practices and risks related to information systems, information security, data privacy and cybersecurity. At least annually, the entire board of directors receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks, and information security considerations arising with respect to our peers and other third parties. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.


text: Cyber Risk Management and Strategy At BJ's, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that our members share with us. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems.


text: Governance Related to Cybersecurity Risks Our Chief Information Officer ("CIO") is responsible for the strategic leadership and direction of the Company's information technology organization. Prior to joining BJ's in 2023, our current CIO served as global chief information officer at a public healthcare company, where she led information technology, privacy assurance, cyber, digital and data security across key business units. She has also held various chief information officer and technology leadership roles at several other healthcare companies and a multinational pharmaceutical corporation, along with other senior management positions during her career.


text: The CIO and the VP of IT Security and Compliance regularly report to senior management and the board on the governance aspects of our data security program. The CIO and the VP of IT Security and Compliance are also members of our information security steering committee, which is comprised of executives throughout the Company who oversee areas such as finance, operations, legal, human resources, strategy and development, digital, and commercial. This committee meets regularly to, as relevant, discuss oversight of the Company's cybersecurity program, program enhancements and new risks or threats that the Company might be facing.


text: The board of directors has overall responsibility for risk oversight, including, as part of regular board meetings, general oversight of executives' management of risks relevant to the Company. The VP of IT Security and Compliance provides an annual cybersecurity update to the board. While the full board has overall responsibility for risk oversight, it is supported in this function by various committees, including principally its audit committee.


text: The audit committee, pursuant to its charter, is responsible for overseeing risk management processes related to cybersecurity. The audit committee assists the board in fulfilling its risk oversight responsibilities by periodically reviewing our enterprise risk management program. Through its meetings with management, including the compliance and information technology functions, the audit committee reviews and discusses significant areas of our business and summarizes the key areas of risk and relevant mitigating factors for the board.


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Additionally, we partner with multiple third-party managed security service providers for enhanced monitoring of our information technology and data security environment and to perform proactive detection and investigation of malicious activity within our network. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes, which processes are integrated into our overall enterprise risk management program.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems. See "Item 1A. Risk Factors" for additional information on the Company's cybersecurity-related risks.


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risks is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect the Company against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning and data security assessments of third-party service providers as a part of vendor management.

companyName: Nine Energy Service, Inc.


text: Identified Risks As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations and/or financial condition. For more information about these risks, see the risk factor titled "Our operations are subject to cybersecurity risks that could have a material adverse effect on our results of operations and financial condition" under Item 1A of Part I of this Annual Report.


text: Board Oversight and Management's Role Our Board considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership, and third parties on cybersecurity matters. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.