text: Engagement of Third Parties Given the complex and evolving nature of cybersecurity threats, the Company periodically engages third parties to assist us in evaluating our security vulnerabilities and developing and maintaining effective cybersecurity risk management. Partnering with third parties enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023, we engaged a global law firm to conduct an external assessment of our cybersecurity governance framework and processes and provide recommendations to improve our cybersecurity readiness and posture. We also work with third party specialists who perform threat and vulnerability assessments, such as penetration testing, and develop strategies to mitigate cybersecurity-related risks.


text: Oversight of Third-Party Risk We are aware of the cybersecurity risks associated with engaging third-party service providers. To mitigate such risks, we conduct security assessments of high-risk third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes ongoing assessments by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: ENTEGRIS INC

ticker: ENTG

secItem: Item 1C


text: To date, the Company is not aware that its business or operations have been, or are reasonably likely to be, materially impacted by these cyberattacks. However, the Company's security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company's, or its third-party service providers', databases or systems.


text: Board of Directors' Oversight The Audit and Finance Committee (the "Audit and Finance Committee") of our Board of Directors is responsible for reviewing and monitoring general IT and cybersecurity matters, including related risks, and reporting to the Board its determinations, actions and recommendations related thereto. Our Audit and Finance Committee is composed of independent directors with extensive executive leadership and risk management experience. Our CISO, together with our CIDO, provide quarterly updates to our Audit and Finance Committee regarding the cybersecurity risk landscape, specific risks affecting the Company and solutions to mitigate those risks, and legal and regulatory requirements relating to cybersecurity. These updates assist the Board in performing its oversight and risk management function. In addition, the full Board receives an annual report on cybersecurity directly from the CISO.


text: Management's Role Managing Risk Our CISO is responsible for the implementation, operation and monitoring of our cybersecurity risk management program. Our current CISO, who reports to our CIDO, has over 20 years of experience managing the IT and cybersecurity operations within large, global organizations. His extensive experience assessing and mitigating cybersecurity risk, implementing governance structures and developing employee training programs is critical in developing and executing our cybersecurity strategies.


text: Monitoring of Cybersecurity Incidents Our Cybersecurity Incident Response Plan establishes how we monitor and respond to cybersecurity incidents impacting our environment. The CISO works closely with members of our Executive Leadership Team and his cybersecurity team to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. We engage a third-party managed security services provider (MSSP) to provide 24/7 continuous monitoring of the Company's IT and operational technology environments for potential cybersecurity incidents. In the event such an incident is identified by our MSSP or any of our employees, our cybersecurity team assigns it a severity classification and escalates the incident accordingly. Depending on the severity of the incident, certain key personnel are notified and work together to further investigate the incident and take actions to respond, which may include engaging with external specialists, regulatory authorities and our cybersecurity insurance carrier. The CISO receives regular updates on all incidents and incident responses, which the CISO shares with our Executive Leadership Team on a weekly basis. Our cybersecurity team conducts a post-incident review of all major cybersecurity incidents, which review includes identification of vulnerabilities, assessment of the incident's impact on the Company and recommendations to help prevent similar incidents in the future. See "Item 1A. Risk Factors" for a more detailed description of the cybersecurity risks we face.


text: The Company has implemented and maintains a cybersecurity program governed by an information security team responsible for managing and directing strategy, policy, standards, architecture, controls, and processes. The cybersecurity program is underpinned by a cybersecurity risk management framework designed to identify and prioritize cybersecurity risks to the Company and is overseen by our Board of Directors.

companyName: LIVEPERSON INC

ticker: LPSN


text: Risk management and strategy Our cybersecurity program is designed to protect our information systems from cyber threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our customers and their users. This involves an ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. LivePerson maintains a security risk management program that is tasked with determining the cybersecurity threats that pose the greatest risk to the Company. This program is managed by the Security Risk Committee, chaired by the Chief Security Officer ("CSO"), as well as representative members from security, operations, and internal audit leadership. The committee meets at least twice annually. A resultant risk assessment produced by the committee is leveraged to inform senior leadership and our Board of Directors on top areas of risk, as well as to shape the security and technology team's roadmap.


text: Our cybersecurity program includes a number of components, such as: • regular cybersecurity risk assessments, audits, and penetration tests; • policies generally aligned with industry standards such as Information Security Standard ("ISO") / International Electrotechnical Commission –27001 and the PCI Data Security Standard; • measures to block and prevent certain malicious activity, such as endpoint detection and response controls; • measures to block and prevent certain network attacks, such as firewalls and Distributed Denial of Service mitigation tools; • measures to secure remote access, such as virtual private networks and multi-factor authentication; • cybersecurity training programs for employees, contractors and agents, including regular phishing simulations; • a vulnerability disclosure program to compensate researchers for responsible disclosure of vulnerabilities in our platform; • the maintenance of a Security Incident Response Plan with periodic tabletop testing; and • third-party risk management processes designed to manage risks associated with vendors and suppliers.


text: The goal of the Company's information security program is to manage risks in a prioritized fashion; however, control gaps and/or their related control effectiveness, resource constraints, and execution failure can pose cybersecurity risk to the Company. In the event of a cyber incident, the Company has a process in place whereby the information security team will alert the appropriate levels of management, as well as the legal and finance departments so that the materiality of any such event can be determined.


text: The Company actively engages with key vendors and industry participants, and monitors and analyzes intelligence and law enforcement community security publications as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its cybersecurity processes. The Company also regularly engages with external parties to perform: • periodic cybersecurity assessments, such as maturity assessments against the National Institute of Standards and Technology Cybersecurity Framework; • managed detection and response for certain public cloud environments; • penetration testing; • continuous proactive threat hunting; • cyber threat intelligence services including dark web monitoring; and • audits against industry standards including Systems and Organization Controls 2 ("SOC 2"), ISO 27001, PCI, and the HITRUST CST.


text: In the ordinary course of our business, our third-party service providers ("TPSPs") collect, process and store certain information and other data related to us or our customers and their users. We assess the cybersecurity practices of our TPSPs through a variety of measures, including a due diligence process designed to assess and manage the potential risks of such TPSPs to the Company. This process involves evaluation of security questionnaires, review of available SOC 2 reports, and performance of interviews prior to onboarding TPSPs over certain risk thresholds, with annual re-reviews for our highest risk tier TPSPs. Despite these measures, we are reliant on the security practices of our TPSPs, which may be outside of our direct control.


text: We experience cyber-attacks of varying degrees on a regular basis in the ordinary course of our business. As of the date of this report and for the time period of January 1, 2023, through December 31, 2023, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. For information on the cybersecurity threats and risks we face and the potential impacts on the business related thereto, see Item 1A. Risk Factors – Risks Related to Security Vulnerabilities and Service Reliability.


text: Our information security team is led by our CSO. Mr. Friedman has held the position of CSO at organizations across multiple industries, including financial services, for over 13 years and holds industry security certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified Information Security Manager, and Certified in Risk and Information Systems Control. Many members of the information security team also hold CISSP, CISA and other security related certifications. The information security team is made aware of security risks and incidents through a number of channels: • performance of risk assessments on at least an annual basis by the Security Risk Committee; • providing SOC capabilities for the detection and response of cyber incidents; • serving as the point of contact for reporting actual or suspected cyber incidents; • managing compliance and certification for in-scope security related compliance frameworks and regulations; • managing internal and external penetration tests, vulnerability scans, and the Company's vulnerability disclosure program; and • monitoring of cyber threat intelligence and evaluation and analysis of the potential impact of "zero day" vulnerabilities.


text: Our Board of Directors takes an active role in overseeing the management of cybersecurity risks to the Company. The information security team provides periodic reports to the Cybersecurity and Technology Committee of the Board, as well as to the full Board, the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the cybersecurity program and the emerging threat landscape. The cybersecurity program is periodically evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors.


text: We experience cyber-attacks of varying degrees on a regular basis in the ordinary course of our business. As of the date of this report and for the time period of January 1, 2024, through December 31, 2024, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. For information on the cybersecurity threats and risks we face and the potential impacts on the business related thereto, see Item 1A. Risk Factors – Risks Related to Security Vulnerabilities and Service Reliability.


text: Our information security team is led by our CSO. Mr. Friedman has held the position of CSO at organizations across multiple industries, including financial services, for over 13 years and holds industry security certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified Information Security Manager, and Certified in Risk and Information Systems Control. Many members of the information security team also hold CISSP, CISA and other security related certifications. The information security team is made aware of security risks and incidents through a number of channels and activities: • performance of risk assessments on at least an annual basis by the Security Risk Committee; • providing SOC capabilities for the detection and response of cyber incidents; • serving as the point of contact for reporting actual or suspected cyber incidents; • managing compliance and certification for in-scope security related compliance frameworks and regulations; • managing internal and external penetration tests, vulnerability scans, and the Company's vulnerability disclosure program; and • monitoring of cyber threat intelligence and evaluation and analysis of the potential impact of "zero day" vulnerabilities.


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Due to the size and scope of our global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Our Management Leadership Team, with oversight from the Board of Directors, has implemented a comprehensive cybersecurity program, including incident response process, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.


text: Our Board of Directors and Management Leadership Team review cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.


text: Board of Directors Oversight Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate data protection and cybersecurity risks.


text: As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board at least annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: Management Role in Cybersecurity Risk Management At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondel z and other major consumer goods and financial services companies. Our CISO currently reports to our Chief Financial Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.


text: Cybersecurity Steering Committee Our Cybersecurity Steering Committee currently includes our CEO, CFO, CISO, General Counsel and Chief Ethics & Compliance Officer and has broad oversight of our cybersecurity risk management processes, in coordination with the rest of the Management Leadership Team and the Board. The Cybersecurity Steering Committee has been established to meet and to discuss our cybersecurity risk management measures designed to identify and mitigate data protection and cybersecurity risks, along with procedures and practices related to incident response, including escalation and notification.


text: Risk Management and Strategy Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our vendor cybersecurity risk management program supports the planning, automation, and management of cybersecurity risk with enrolled suppliers and other third parties, focusing on risk-based assessments. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, penetration tests, vulnerability scanning, internal audits, and external audits of our cybersecurity program. We also leverage assessors, consultants, auditors and third-party service providers, including threat intelligence to inform our understanding of the cybersecurity threat landscape and enable risk-based measures to defend against evolving threats.


text: Incident Response We have a Cybersecurity Incident Response Plan ("CSIRP") to provide the organizational and operational structure, processes, and procedures for investigating, containing, documenting and mitigating cybersecurity incidents, including keeping senior management and other key stakeholders informed and involved as appropriate.


text: Our Cybersecurity Incident Response Team manages and executes technical response activities in coordination with our Security Operations Center, subject matter experts and others to respond to a cybersecurity incident. The objectives of the CSIRP include to: • Establish the Company's cybersecurity incident response process and provide actionable guidelines to provide a timely, consistent, and repeatable response process; • Describe the requirements and expectations for cybersecurity incident response; • Set forth the roles and responsibilities for cybersecurity incident response personnel; • Establish cybersecurity incident classification, escalation, and prioritization parameters; • Confirm the documentation process for cybersecurity incidents affecting the Company and the Company's responses are appropriately documented; • Establish protocols for materiality determinations for cybersecurity incidents under the SEC's cybersecurity rules; • Establish the process for assessing when public disclosure and external communications may be required; and • Mitigate or minimize the effects of a cybersecurity incident on the Company, its personnel, customers, consumers, or others and limit financial, operational, legal, and reputational impact.


text: Material Cybersecurity Risks, Threats & Incidents We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board more frequently than annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: Management Role in Cybersecurity Risk Management At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondel z and other major consumer goods and financial services companies. Our CISO currently reports to our Chief Information and Digital Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.


text: Material Cybersecurity Risks, Threats & Incidents We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. While we have not experienced a known material information security breach nor incurred material breach-related expenses over the last three years, there can be no guarantee that we will not be the subject of future cybersecurity threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: We have a cybersecurity program to identify, monitor, and mitigate cybersecurity risks. The security program consists of formal roles and responsibilities for information security and incident response, and is overseen by our IT Steering Committee, which consists of key executives and employees, with guidance from our third-party cybersecurity vendor. Our enterprise risk management program considers cybersecurity risks alongside other company risks, and we consult with subject matter experts to gather information necessary to identify cybersecurity risks, evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. In addition to continuous cyber monitoring, the IT Steering Committee participates in quarterly updates with cybersecurity experts which include reports from these experts on identification of new cyber risks and threats, reported vulnerabilities, trend analysis on attack vectors, and monitoring of risk mitigation activities.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Management provides cybersecurity program briefings to the Audit Committee on at least an annual basis, and more frequently if circumstances warrant. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on NOG's investments in cybersecurity risk mitigation and governance.


text: We have a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multifactor authentication, data backup, security monitoring, mobile device management and asset management. Management performs annual testing of security controls and results are reported to the Audit Committee. In addition, management has a formal incident response plan and has contracted with a cybersecurity operations vendor to provide 24x7 monitoring/management of our infrastructure and systems. The incident response plan addresses the lifecycle of incidents including identification, response and recovery, and the plan is tested at least annually. In addition, we carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Management maintains an inventory of third parties and completes an annual third-party cyber risk assessment. In addition, employees participate in mandatory annual cyber training and management conducts routine social engineering tests to monitor employees' awareness of cyber risks and to train employees on how to identify potential cybersecurity risks.


text: In the last fiscal two years, we have not experienced any material cybersecurity breach incidents. For additional information about our cybersecurity risks, please see "Item 1A. Risk Factors – We depend on computer and telecommunications systems, and failures in our systems or cybersecurity attacks could significantly disrupt our business operations."


text: We have a cybersecurity risk management program to identify, monitor, and mitigate cybersecurity risks. The program consists of formal roles and responsibilities for information security and incident response, and is overseen by our IT Steering Committee, which consists of key executives and employees with guidance from our third-party cybersecurity vendor. Our enterprise risk management program considers cybersecurity risks alongside other company risks, and we consult with our cybersecurity vendor to gather information necessary to identify cybersecurity risks, evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. In addition to continuous cyber monitoring, the IT Steering Committee participates in quarterly cyber updates with our cybersecurity vendor, which includes identification of new cyber risks and threats, reported vulnerabilities, trend analysis on attack vectors, and monitoring of risk mitigation activities.


text: The Audit Committee has ultimate oversight of cybersecurity risks and our cybersecurity risk management program. Management provides cybersecurity program briefings to the Audit Committee on at least an annual basis, and more frequently if circumstances warrant. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance. Management utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guideline to manage our cybersecurity risks and inform the Audit Committee on the overall progress of our information security program.


text: We have a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multi-factor authentication, data backup, security monitoring, mobile device management and asset management. Management performs annual testing of security controls, including penetration testing from a different cybersecurity vendor that is independent of both our Company and the cybersecurity vendor that provides guidance on our overall cybersecurity program, and results are reported to the Audit Committee. In addition, management has a formal incident response plan and our cybersecurity vendor provides 24x7 monitoring/management of our infrastructure and systems. The incident response plan addresses the lifecycle of incidents including identification, response and recovery, and the plan is tested at least annually. In addition, we carry insurance that provides protection against the potential losses arising from cybersecurity incidents.


text: Management maintains an inventory of third parties (e.g., vendors, consultants, etc., from whom we may face cybersecurity risk in connection with our relationship) and completes an annual third-party cyber risk assessment. In addition, employees participate in mandatory annual cybersecurity training and management conducts routine social engineering tests to monitor employees' awareness of cyber risks and to train employees on how to identify potential cybersecurity risks.


text: In the last two fiscal years, we have not experienced any material cybersecurity breach incidents. For additional information about our cybersecurity risks, please see "Item 1A. Risk Factors – We depend on computer and telecommunications systems, and failures in our systems or cybersecurity attacks could significantly disrupt our business operations."


text: We incorporate assessment of our cybersecurity initiatives into our Enterprise Risk Management program. The Enterprise Risk Management program evaluates risk areas including, but not limited to, operational risk, intellectual property theft, fraud, harm to employees, patients, or third parties, and violation of privacy or security-related laws or regulations. As part of our efforts to mitigate cyber risk, we have implemented cybersecurity processes, technologies, and controls designed to identify and manage potential material cyber risks and have obtained cyber-specific insurance coverage.

companyName: INSMED Inc

ticker: INSM


text: We employ a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessment and penetration testing, to update our ongoing risk identification and mitigation efforts. We have a cybersecurity assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the Center for Internet Security. Our processes also assess cybersecurity risks associated with our use of third-party service providers. We proactively engage with key vendors, industry participants, and law enforcement/cyber threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our information security program is managed by a senior director who reports to the Chief Information Officer (CIO), providing routine security program updates and briefings. The current senior director has more than 25 years of experience in cybersecurity, federal law enforcement, and cyber investigations, while possessing the required subject matter expertise, skills, experience, and industry certifications expected of an individual assigned to these duties. Our information security team, which includes the CIO and senior director, as well as additional professionals, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. Our CIO provides regular updates to our Chief Executive Officer and other members of management. The Audit Committee of the Board of Directors is responsible for oversight of the Company's cybersecurity risk exposure and the CIO provides reports to the Audit Committee, as well as the full Board of Directors, at least annually. The reports to management and our Board include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. For the year ended December 31, 2023, we are not aware of any material cybersecurity incidents.


text: Our information security program is managed by a senior director who reports to the Chief Information Officer (CIO), providing routine security program updates and briefings. The current senior director has more than 25 years of experience in cybersecurity, federal law enforcement, and cyber investigations, while possessing the required subject matter expertise, skills, experience, and industry certifications expected of an individual assigned to these duties. Our information security team, which includes the CIO and senior director, as well as additional professionals, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. Our CIO provides regular updates to our Chief Executive Officer and other members of management. The Audit Committee of the Board of Directors is responsible for oversight of the Company's cybersecurity risk exposure and the CIO provides reports to the Audit Committee, as well as the full Board of Directors, at least annually. The reports to management and our Board include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents.


text: Risk Management and Strategy We maintain a cybersecurity program designed to protect our company, company data, customer data and personal data within information systems used by the Company. In order to respond to potential cybersecurity threats, we maintain policies, procedures and systems that provide for controls on detecting and addressing cybersecurity threats, including a formal incident response plan. We also maintain business continuity and disaster recovery capabilities, which we test regularly.

companyName: MATERION Corp

ticker: MTRN


text: We have a process designed to address cybersecurity threats at third parties, including service providers, that handle, possess, process and store our information.


text: The oversight of our cybersecurity risk is integrated into our enterprise-wide risk management process. We have a dedicated global cybersecurity team that monitors potential cyber threats and leads our business continuity risk management. We have business continuity plans that identify our critical business systems, establish recovery objectives and create methods for implementing such plans within our business. Our business continuity plans encompass disaster recovery at our data centers such that business operations continue with no or minimal impact. Our business continuity plans will continue to evolve, with the goal of enabling us to operate and maintain our essential functions in the event of a crisis.


text: In addition, we engage third-party assessors, consultants and other third parties from time to time to assist us with assessing, enhancing, implementing, and monitoring our cyber security risk-management programs. We review the results of the assessments and reviews of these third-parties and determined whether to adjust our cybersecurity policies and processes based on their recommendations.


text: We detect frequent attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of the filing of this Form 10-K, we are not aware of and do not believe that any such attempts that have occurred since the beginning of 2023 that have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition. However, there can be no assurance that our protection efforts will be successful. See "Risks Relating to Our Business and Operations – A security incident impacting customer, employee, supplier, or Company information, or Company systems or infrastructure, may have a material adverse effect on our business, financial condition, and results of operations." in "Risk Factors" on page 9 of this Form 10-K.


text: While our Board has the ultimate oversight responsibility for the risk management process, the responsibilities of the Audit and Risk Committee of our Board include overseeing cybersecurity. As part of its program of regular oversight, all members of the Audit and Risk Committee are responsible for overseeing cyber, information security, and information technology risk, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks.


text: The Audit and Risk Committee receives at least quarterly reports from our Chief Information Officer on our information technology and cyber risk profile, enterprise cyber program, key enterprise cyber initiatives, and significant updates on external audits of our information security program.


text: The full Board attends one of the Audit and Risk Committee meetings at which information technology and cyber risk are discussed. Additionally, at least annually, the full Board attends a cybersecurity training from external experts and reviews and discusses our technology strategy with the Chief Information Officer and approves our technology strategic plan.


text: Our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including cybersecurity risks. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our Chief Information Officer reports directly to our Chief Executive Officer. Pursuant to our formal incident response plan, suspected cybersecurity incidents are first evaluated by our "Initial Incident Response Team" led by our Chief Information Officer and comprised of representatives from our information technology, human resources, safety, legal, finance and communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to our executive incident response team, which includes our Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.


text: Steve Holt is our Chief Information Officer, a role he has had since he joined Materion in November 2017. Mr. Holt has 40 years of experience in the information technology industry. Prior to joining Materion, Mr. Holt served as Chief Information Officer at Chart Industries as well as other IT-focused positions at TechnOptics, Accuride Corporation and Navistar.


text: We detect frequent attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of the filing of this Form 10-K, we are not aware of and do not believe that any such attempts that have occurred since the beginning of 2024 that have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition. However, there can be no assurance that our protection efforts will be successful. See "Risks Relating to Our Business and Operations – A cybersecurity incident impacting customer, employee, supplier, or Company information, or Company systems or infrastructure, may have a material adverse effect on our business, financial condition, and results of operations." in "Risk Factors" on page 10 of this Form 10-K.


text: The full Board attends two of the Audit and Risk Committee meetings at which information technology and cyber risk are discussed. Additionally, at least annually, the full Board attends a cybersecurity training from external experts and reviews and discusses our technology strategy with the Chief Information Officer and approves our technology strategic plan.


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Board oversees management's execution and performance of its risk management responsibilities, which includes cybersecurity threats. The Board receives at least one cybersecurity report every quarter from our Chief Information Officer, our Chief Information Security Officer, our Chief Risk Officer or other professionals. The Board also reviews and approves the business resiliency and information security programs intended to guard against cybersecurity and related risks. Lastly, the Board receives input on cybersecurity issues from external entities such as our independent auditor, regulators and consultants. Each of these steps further the Board's efforts to ensure we have established and are proactively maintaining an enterprise-wide cybersecurity risk program with appropriate policies, practices and controls designed to ensure resiliency in the face of emerging threats.


text: Management holds relevant expertise in assessing and managing cybersecurity threats. Numerous members of management and employees across the information security and risk functions hold nationally recognized designations or certifications, including the Certified Information Systems Security Professional designation, Global Information Assurance Certifications or Amazon Web Services Cloud Certifications. We also provide role-based security training to workers with assigned information security-related roles and responsibilities. This includes topics on social engineering tactics and other general threats posed for system compromise and data loss. The initiatives and processes discussed further below also contribute to the expertise and experience of management.


text: The framework for our overall process for managing risk encompasses the management of risks posed by cybersecurity threats and is discussed further in Item 1. "Business, Risk Management." As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization.


text: We test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing and adversary emulation, also known as red teaming, and hire a third party to do the same at least once a year. We also undergo a third party maturity assessment of our information security program every two years and a third party enterprise penetration test annually. We leverage external resources to help define information security and technology standards for our environment.


text: Our cybersecurity controls are monitored and refined based on learnings from regular red team engagements and analysis by threat hunters. All cyber defense operations are enriched through a dedicated cybersecurity threat intelligence function. We collaborate with information security peers across the industry to maximize threat intelligence. Our threat intelligence program helps create awareness and understanding of potential cybersecurity threats and adversaries. We proactively assess potential risks presented by new services or systems integrated with our network or data and ensure appropriate controls are applied under such circumstances. We perform due diligence and monitor third party relationships based on risk profile to assess the suitability of their cybersecurity controls and protocols for the business operations or services for which they are engaged.


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have empowered and conditioned our global workforce to recognize and resist phishing attempts with our simulated phishing program. At least quarterly, our employees are presented with simulated phishing scenarios that deliver hands-on experience and on-the-spot education opportunities. All engineers and employees holding equivalent roles who are involved in software development also receive mandated secure software development training.


text: We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise. The plan ensures stakeholders across the organization are identified who have the appropriate experience, training and expertise in incident management, and that the organization is well positioned to address incidents. For example, we carry out cybersecurity incident response exercises to develop widespread familiarity and experience in responding to cybersecurity incidents.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: Risk Management and Strategy Our Board of Directors oversees our risk management program, and because information security is a top priority and an important component of our day-to-day operations, cybersecurity is part of our overall approach to enterprise risk management. The scope of cybersecurity risk management encompasses all aspects of business operations, including supply chain risks and production manufacturing operations. Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology. We recognize the importance of the secure protection of our employee, customer, supplier and partner data and address material risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, security and availability of the information that we collect and store.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Security Operations ("SecOps") team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, followed by assessing and prioritizing risks. We employ various tools and techniques like threat modeling, vulnerability scanners, and penetration testing. Based on the assessment, security measures are implemented. We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings "We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results" and "We may be subject to information technology failures that could damage our reputation, business operations and financial condition" included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: In the last three fiscal years, we have not identified any cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.


text: We have an Information Security Steering Committee (the "ISSC"), comprised of members of our executive team, our Chief Information Officer, CSO, and Chief Legal Officer. Our CSO, in coordination with the ISSC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our SecOps team communicates with and reports to the CSO, enabling the CSO and the ISSC to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO has over 25 years of security experience in multiple technology disciplines, including prior work experience leading cybersecurity teams, technology strategies and security architecture. He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional ("CISSP") and a Certified Secure Software Lifecycle Professional ("CSSLP"), and holds Honors BSc degrees in Computer Science and Physics.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.


text: With respect to overseeing and identifying cybersecurity risks associated with third parties, we seek to impose certain cybersecurity requirements on critical third parties with whom we do business. The cybersecurity team performs risk assessments, due diligence checks and validation of key security controls in accordance with our cybersecurity policies and standards for third-party vendors and service providers with whom we exchange information or integrate our information systems and networks. We include cybersecurity and privacy addenda and clauses in our agreements with such third parties where applicable and seek to pass through any necessary regulatory and contractual requirements to such third parties. When we do become aware that a third-party vendor or service provider has experienced a compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate or by exercising any applicable contractual remedies we may have, such as a right to indemnification.


text: On a semi-annual basis the cybersecurity team conducts a program performance evaluation with management to assess the continuing suitability, adequacy and effectiveness of the Company's cybersecurity risk management program, including with respect to the fulfillment of cybersecurity objectives and compliance with industry standards, and to recommend changes to the Company's threat modeling, priorities for future risk assessments, policy adjustments in response to newly identified risks or non-compliance, and overall risk acceptance.


text: To foster a culture of cybersecurity awareness within the Company and provide employees with further knowledge of cybersecurity-conscious behavior, all employees of the Company are required to attend cybersecurity training sessions during the onboarding process and at least once per year.


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS Services, Cisco Systems, Inc. and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint Systems Inc. and Cisco Systems, Inc. as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity team regularly meets with the COO to report its findings. The COO in turn periodically reports on such matters to the Chief Executive Officer and other members of management.


text: As part of our continued investment in developing our overall enterprise risk management program, the COO and other members of management make updates to the full board of directors, and going forward beginning in 2024, will also provide updates to the audit committee of our board of directors (the "Audit Committee"), on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents. Both management and the Audit Committee also report material cybersecurity risks to our full board of directors, based on management's assessment of risk.


text: In 2023, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this annual report on Form 10-K.


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) in relation to our program.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices.


text: a multi-disciplinary security team overseen by our Information Security Council, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis;


text: the use of a third-party Managed Security Service Provider (MSSP) that includes a 24x7 security operations center (SOC) that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Detection and Intrusion Prevention (IDS/IPS) that scans data in transit to help detect and prevent the execution of harmful code; and a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.


text: Our management formed an interdepartmental Information Security Council (ISC), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.


text: Our management teams, including the ISC, our CIO, Vice President of Infrastructure Services, and others within our Information Technology department, as appropriate, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees all cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST


text: Our Chief Information Officer and his team are responsible for leading our cybersecurity strategy, policy, standards, architecture, and processes. Our information security leadership team has more than 20 years of combined experience in cyber and information security matters. Our information security program is also supported by our Chief Compliance Officer and other members of senior management. We conduct periodic reviews of our program by internal and external experts with the results of those reviews reported to senior management and the Board. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners. For example, we require certain third-party service providers and other business partners to provide us with SOC II reports that demonstrate compliance with security standards. We also actively engage with industry participants, as well as intelligence and law enforcement communities as appropriate, as part of our continuing efforts to evolve our cybersecurity governance.


text: Our information security team promptly informs our Incident Response Team of potentially material cybersecurity incidents, including with respect to our third-party service providers. The Chief Information Officer briefs our Co-Chief Executive Officers and reports to the Audit Committee of our Board (the "Audit Committee"). The Audit Committee, in turn and if necessary, briefs the Board on, among other matters, our cyber risks and threats, the status of projects to strengthen our information security systems (such as employee cybersecurity training), an assessment of the information security program, and the emerging threat landscape. The Cybersecurity and Compliance Steering Committee, comprised of senior members of management, has convened and is scheduled to convene on a quarterly basis to review all matters related to strengthening our cybersecurity posture and providing governance.


text: For a discussion regarding risks from cybersecurity threats that are reasonably likely to affect the Company, see "Part I, Item 1A – Risk Factors – Our use of information technology and third party service providers exposes us to cybersecurity breaches and other interruptions that could disrupt our business operations and adversely impact our reputation and results of operations" and "If we fail to comply with data privacy and personal data protection laws, we could be subject to adverse publicity, government enforcement actions and/or private litigation, which may negatively impact our business and operating results."


text: Risk Management and Strategy We depend on technology systems, some of which are operated and managed by third parties, to operate our business. Our business is limited to searching for and implementing an initial business combination. As such, we process a limited number of invoices and rely primarily upon third parties for cybersecurity compliance. Only four individuals are involved in our day-to-day operations and those operations are minimal.

companyName: ExcelFin Acquisition Corp.


text: In October 2023, we made payments on three separate invoices which payments were later determined by management to have been made in error. Two of the payments were later recovered from the vendors, but it is unlikely that the third payment will be recovered. Our management has conducted a thorough investigation related to these events and has concluded there was a material weakness in our internal control over financial reporting related to our review and approval of cash disbursements.


text: To address this material weakness management has devoted, and plans to continue to devote, significant effort and resources to the remediation and improvement of our system for verification of which invoices to pay. We implemented additional controls related to vendor verification and will introduce mandatory cybersecurity training. We implemented a list of specific points to validate before payments are released, requiring evidence of validation by approvers.


text: Our cybersecurity risk management program includes the monitoring of our systems and networks for vulnerabilities, threats and, intrusions; coordination of our response to cybersecurity incidents; the training for our management and employees on new and developing risks and threats. Finally, our cybersecurity risk management program includes procedures to facilitate that information regarding cybersecurity incidents are shared with the Board to enable assessments related to disclosure and notice requirements to be timely and correctly made.


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Board of Directors is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures.


text: Our Chief Executive Officer, Joe Ragan, leads management's assessment, identification and management of cybersecurity risk. Mr. Ragan is familiar with cybersecurity matters arising out his public company chief financial officer experience. Our Board of Directors oversees our enterprise risk management system. The Board of Directors meets quarterly, or more frequently as necessary, with members of management to provide updates on all matters, including cybersecurity.


text: Cybersecurity Risk Management and Strategy We have established an Information Security department within our Risk Management department that is independent of the Information Technology department. Furthermore, we have a documented Information Security Strategy that guides the Information Security teams and business departments across the Company. The Information Security Strategy incorporates the external landscape, risk assessments, Company's strategy, information technology strategy and other inputs.

companyName: Sterling Bancorp, Inc.


text: Our appetite for cybersecurity risk is established within our enterprise risk appetite. We undertake an information technology risk assessment annually. This assessment considers our information assets, the potential threats/risks to those assets and the effectiveness of existing controls to identify and assess inherent and residual levels of information security risks. This assessment also identifies any control gaps that may exist and informs appropriate mitigation strategies to conform to our appetite for cybersecurity risk. Remediation plans for any identified gaps are monitored by management quarterly. Results from this risk assessment may affect changes in the Information Security Strategy and information security budget. Annually, we engage a third-party audit firm specializing in information technology audits to review the risk assessment and our Information Security Program overall as part of our information technology general controls audit.


text: We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition.


text: We use a security framework to guide our overall security posture, which has helped us develop and enhance our Information Security Policy, Incident Response Policy and Business Continuity Policy. These policies guide us in our effort to manage and control information technology risk and to define and communicate information security responsibilities and accountability throughout the Company. These policies also set the requirements to help ensure that we safeguard our data and information systems to reduce risk and minimize the effect of potential incidents. These policies are supported by written standards and procedures that ensure conformity with the policies that the board of directors has set forth. Pursuant to our Incident Response Policy, we have adopted a written Incident Response Plan that documents employee and management responsibilities, incident classifications and the procedures to be followed during a cybersecurity incident. The Incident Response Plan is tested annually through a tabletop exercise led by a third-party vendor who assists in developing and executing the exercise.


text: We have a documented Third-Party Risk Management Policy and Program to ensure that our vendor relationships are assessed, monitored and documented appropriately. It is our policy to exercise appropriate oversight and risk management of the activities conducted through significant third-party relationships, taking into consideration the nature, magnitude, complexity and risk potential of the arrangement. Vendors are monitored for cybersecurity issues during the initial onboarding processes and on an ongoing basis. We may review or require a SOC 2 Type 2 report, cybersecurity controls, cyber insurance and monitoring frequency depending on our assessment of the risk of any vendor.


text: Management performs ongoing monitoring of the Information Security Program with a range of reports and tools that are commensurate with our risk profile. These reports and tools ensure the program continues to comply with all policies related to information technology risk and information security.


text: We have engaged a third-party provider that manages and monitors our Security Operations Center, including our firewall and intrusion detection and prevention system. Additionally, management has engaged a separate vendor to monitor and manage endpoint detection and response applications on all Company devices, including workstations, laptops and servers.


text: Additional controls include vulnerability scanning, identity and access management, mobile device management and other various security controls. We also conduct periodic phishing tests and social awareness training for all employees, which include how to report and escalate suspected incidents.


text: Information security metrics are reported quarterly to the Information Technology Steering Committee, the Enterprise Risk Management Committee and the Board Risk Committee to provide evidence of the effectiveness of these controls and tools. Any identified specific gaps in the controls are sent to management quarterly until resolved.


text: Cybersecurity Governance Cybersecurity risks and activities are reported quarterly to the Information Technology Steering Committee and the Enterprise Risk Management Committee. The Bank's chief risk officer and interim chief information officer are part of the Information Technology Steering and Enterprise Risk Management Committees. The Bank's chief risk officer has over 15 years of experience managing the supervision of Information Security risks for financial institutions. The Bank's interim chief information officer has over 30 years of experience managing technology.


text: We have also employed a chief information security officer who reports to the chief risk officer. The chief information security officer is responsible for information security, information technology risk management, vendor management and business continuity programs. The chief information security officer holds a graduate degree in cybersecurity and numerous information security certifications, including certified information systems security professional, certified information security manager, certified cloud security professional and qualified technology expert. Additionally, the chief information security officer has worked in the information security field for over 20 years within several financial institutions, implementing cybersecurity strategies, programs, policies and procedures.


text: Our Board Risk Committee generally meets quarterly and is responsible for overseeing cybersecurity risk and our information security program, including cybersecurity, and ensuring the continued development of the program as the Company grows and cyber and information risk exposures change. At each Board Risk Committee meeting, the chief information security officer presents information security metrics and any updates to the Information Security Program. New and changing cybersecurity risks are discussed when needed. The chair of the Board Risk Committee also serves as a board member and previously served as the chair and interim chief executive officer of the Information Systems Audit and Control Association. As a board member of the Information Systems Audit and Control Association, she is a member of their Audit and Risk Committee, Compensation and Human Capital Committee and Governance and Nominating Committee. All cybersecurity-related policies are reviewed and approved annually by the chief information security officer, chief risk officer, Enterprise Risk Management Committee, Board Risk Committee and the board of directors.


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: VOC Energy Trust

ticker: VOC


text: Risk Management Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Risk Management Oversight and Governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.


text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders. We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: Governance and Oversight: Our Board of Directors and senior management are actively involved in overseeing our cybersecurity policies and practices and managing those responsible for coordinating and implementing cybersecurity initiatives across the organization.


text: Risk Assessment and Management: We conduct risk assessments to identify potential cybersecurity threats and vulnerabilities. This includes evaluating the likelihood and potential impact of various threats, such as data breaches, malware attacks, and insider threats. Based on these risk assessments, we develop and implement risk management strategies to mitigate identified risks.


text: Information Security Policies and Procedures: We have established information security policies and procedures that govern the use, protection, and handling of sensitive information. These policies cover areas such as data encryption, access controls, password management, incident response, and employee training.


text: Network and Infrastructure Security: We employ a range of technical measures to secure our network and infrastructure, including firewalls, intrusion detection and prevention systems, and vulnerability assessments. We also use encryption to protect data both in transit and at rest.


text: Employee Training and Awareness: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.


text: Third-Party Risk Management: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.


text: Compliance and Reporting: We comply with all applicable laws and regulations related to cybersecurity, including data protection and privacy laws.


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders.


text: We recognize the critical importance of maintaining the trust and confidence of investors, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.


text: To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior on systems used by TMC employees, alongside other technical safeguards including: Web Application Firewalls (WAF) Endpoint protection and response Security Event and Incident Management (SIEM) Identity and Access management (IAM)


text: Multi-factor authentication We utilize a third-party consultancy to provide services including security audits, CISO, risk management and response strategies. This consultancy provides the Chief Technology Officer, who is responsible for leading our cyber security strategy, guidance on policy, standards and processes alongside managing the risk management process.


text: We identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, and the ISO specifically basing our policies and procedures on ISO 27001 guidelines.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; dark web scanning to determine any leaked credentials both corporate and personal for key employees.


text: leverage the NIST incident handling framework and our MSPs to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident;


text: carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are dependent upon information technology systems, which are subject to cyber threats, disruption, damage and failure" which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats, as part of our Enterprise Risk Management system. In the event of a cybersecurity incident that meets established reporting thresholds, our audit committee will receive prompt and timely information regarding such incident, as well as ongoing updates until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer with guidance from external security consultant. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications, including Certified Information Security Manager and Certified CISO. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, have experienced, and will continue to experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF