text: We engage external vendors to assess the cybersecurity program as needed. An independent third party, never used consecutively, performs annual multi-stage penetration testing of our IT environment.


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.

companyName: InterDigital, Inc.

ticker: IDCC

secItem: Item 1C


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: InterDigital evaluates cybersecurity risks as part of our overall enterprise risk management. A cybersecurity steering committee of senior executives is responsible for assessing and managing cybersecurity risks. The steering committee meets annually to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. The steering committee is led by the Director of Cybersecurity & Networks, a cybersecurity professional with 20 years of experience and industry-recognized certifications. The Director of Cybersecurity & Networks reports directly to the Chief Information Officer ("CIO") and manages our cybersecurity team, which uses multiple internal and external sources to keep up to date on the latest threats and risks and manages a process to evaluate cybersecurity risks associated with third-party service providers.


text: Our cybersecurity team also maintains a comprehensive set of cybersecurity policies and standards. We continually reassess and review our cybersecurity strategy and policies, including through tabletop exercises, to identify and proactively address the constant changes in the global threat landscape. We also engage external vendors to assess the cybersecurity program as needed, including annual multi-stage penetration testing of our IT environment by independent third parties.


text: The Audit Committee of our Board oversees risk from cybersecurity threats. The Audit Committee of the Board and the full Board each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.


text: The comprehensive set of cybersecurity policies and standards maintained by the cybersecurity team includes a security incident response framework. The framework is a set of coordinated procedures and tasks that the InterDigital incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the CIO, cybersecurity steering committee, and Audit Committee are kept informed on the status of potential cybersecurity incidents. The CIO also presents a summary of recent incidents at each regular Audit Committee meeting.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. However, to date, cybersecurity threats have not materially affected us, including our business strategy, results of operations, or financial condition. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of criminal cyber threat actors and ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Risk Management and Strategy Under our Shared Services Agreement with D.R. Horton, D.R. Horton provides us with certain administrative and compliance services which includes information technology, internal audit and information technology risk services. Leveraging these services provided by D.R. Horton related to cybersecurity, we have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by the D.R. Horton Chief Information Officer (CIO) and Cyber Security Risk Officer (CSRO).

companyName: Forestar Group Inc.

ticker: FOR


text: We have implemented processes to assess, identify, and manage risks from cybersecurity threats, including the following: • Multi-factor Authentication: We secure access to our network and systems through multi-factor authentication. • Layered Email Protection: We have adopted a layered approach to email protection. • Zero-Trust Security Model: We are working towards a zero-trust security model, utilizing group-based access controls to manage network resources. • Continuous Monitoring: We continuously monitor our systems for security anomalies, to help enable early detection of issues and facilitating a rapid response. • Regular Scans: We conduct weekly and monthly scans to identify and prioritize the mitigation of the most critical vulnerabilities. • Quarterly Penetration Testing: We engage third-party consultants to perform quarterly penetration testing, examining our environment from various perspectives, including end-user and employee use cases, to thoroughly assess system vulnerabilities. • Collaborative Evaluation and Remediation: In collaboration with our third-party consultants, we evaluate the outcomes of our testing, address and remediate any identified issues, and subsequently re-test the environment to confirm that the mitigations have effectively resolved the vulnerabilities. • Regular Assessments and Gap Analyses: Our cybersecurity team regularly meets with the third-party consultants to assess overall risk and conduct gap analyses, ensuring the effectiveness of our current cybersecurity measures. • Comprehensive Risk Assessment: Our comprehensive risk assessment includes evaluating potential security risks associated with the use of external service providers. • Incident Response Readiness: We maintain a documented incident response readiness process that details the procedures to follow in the event of a security incident. • Data Backup: We maintain comprehensive backups of all system files to facilitate data recovery during a security incident. In addition to the above-described technology controls, we have implemented mandatory training and awareness programs designed to educate our employees on cybersecurity risks. These include periodic exercises to help employees identify phishing schemes and other social engineering tactics, and we provide various methods for them to report suspicious activity that may give rise to a cybersecurity incident.


text: Our Board of Directors (Board) considers cybersecurity and other information technology risk as part of its risk oversight function. The members of our Board hear presentations on our cybersecurity risks and risk management on an annual basis from D.R. Horton's CIO and CSRO. These presentations include reviewing current trends, processes and systems used to mitigate the risk of cybersecurity threats. Our internal audit department also conducts cybersecurity reviews as part of its audit procedures and presents any findings to the Board. We have protocols by which certain cybersecurity incidents would be escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We invest a considerable amount of resources in training, tools and other resources to manage risks from cybersecurity threats. Our cybersecurity program is led by an experienced team that creates cybersecurity policies and procedures and possess expert knowledge related to controls and safeguards related to cybersecurity. The cybersecurity team, led by the D.R. Horton CIO, is responsible for assessing and managing risks from cybersecurity threats. The D.R. Horton CIO receives reports on cybersecurity threats from the cybersecurity team on an ongoing basis and in conjunction with the CSRO, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The D.R. Horton CIO and CSRO work closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: D.R. Horton's CIO has more than 35 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, the D.R. Horton CIO has led governance, risk, and compliance technology programs and information security programs. The D.R. Horton CIO currently reports to the D.R. Horton CFO.


text: D.R. Horton's CSRO has more than 23 years of experience working in information technology and cyber security roles including software development, identity and access management projects, privilege account management and multifactor authentication implementations. While in those roles, the D.R. Horton CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The D.R. Horton CSRO currently reports to the D.R. Horton CIO.


text: Supporting the D.R. Horton CIO and CSRO is a dedicated cybersecurity team that designs and monitors our cybersecurity control framework as well as implements cybersecurity control systems and solutions. The D.R. Horton cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Security+, Network+, AQS Certified Cloud Practitioner and Certified Information Systems Auditor.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."

companyName: CALIX, INC

ticker: CALX


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") since its formation in 2017 oversight of business continuity, cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Chief Commercial Operations Officer and Chief Product Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. They stay informed about and monitory the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity management team includes our corporate vice president of information technology, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response, and global operations, and our senior vice president of cloud and engineering operations, who leads the operational teams responsible for product and cloud security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations, and governance, and hold various IT security industry certifications and have received specialized cybersecurity training.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the MITRE ATT&CK framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and MITRE ATT&CK as guides to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Key aspects of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing; (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") since its formation in 2017 oversight of business continuity, cybersecurity, privacy and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Chief Commercial Operations Officer and Chief Product Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Commercial Operations Officer has played a pivotal role in enhancing the Company's cybersecurity frameworks across the enterprise through his experience in risk management and IT governance. He has overseen the implementation of data governance and data protection policies and has been instrumental in fostering a culture of cybersecurity awareness across the organization. Our Chief Product Officer has significantly contributed to the Company's cybersecurity efforts through his experience in product management and development. He has been instrumental in integrating security by design and privacy by design into our products, helping to ensure that cybersecurity is a core component of our product strategy. Collectively, they stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity management team includes our Corporate Vice President, Information Technology, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response and global operations, and our Senior Vice President of Cloud and Engineering operations, who leads the operational teams responsible for product and cloud privacy and security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations and governance; hold various IT security industry certifications and have received specialized cybersecurity training.


text: Risk Management and Strategy Management of cybersecurity risks is a component of the Company's overall risk management strategy. The Company relies on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. The Company's operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. The Company's cybersecurity risk management strategy is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: The Company's cybersecurity program is managed by a dedicated Director of Information Technology. The Company's Director of IT has more than 25 years of experience in the design and implementation of IT infrastructure, including cybersecurity features, and holds a variety of relevant certifications. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring and testing the Company's cybersecurity program.


text: The Company has implemented and maintains various information security processes designed to identify, assess and manage risks from cybersecurity threats to its computer networks, communication systems, hardware and software and its critical data and confidential information. These include conducting scans of the threat environment and conducting vulnerability assessments. The Company has also implemented and maintains various technical and physical measures to mitigate material risks from cybersecurity threats including incident detection and response, disaster recovery and business continuity plans, internal controls within the Company's accounting and financial reporting functions, data encryption, network security and access controls, including multi-factor authentication, as well as physical security. The Company also conducts cybersecurity awareness training annually for employees and provides cybersecurity updates during regularly scheduled meetings, that occur at a minimum monthly, throughout the year. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks across all Company functions.


text: Given the ever-changing cyber risk landscape the Company continues to evolve its oversight process. During the year ended December 31, 2023, the Company conducted an assessment in accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is in the process of implementing additional policies and procedures to further enhance the Company's cybersecurity practices.


text: The Company conducts annual reviews of third-party hosted applications where sensitive Company data is shared. The owners of such applications are required to document user access reviews at least annually and provide the Company with a System and Organization Controls (SOC) 1 report. The Company's assessment of risks associated with the use of third-party providers is part of its overall cybersecurity risk management strategy.


text: The Company is not aware of any risks from cybersecurity threats, including any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Company, including its business, results of operations or financial condition. Refer to Item 1A. Risk Factors in this annual report on Form 10-K, specifically "The Company faces risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of its information technology ("IT") networks and related systems," for additional discussion about cybersecurity-related risks.


text: The Company's board of directors has overall responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The audit committee provides oversight of the Company's cybersecurity, information security and technology risk exposures, including the steps management has taken to identify, assess, monitor and control cybersecurity risks.


text: The day-to-day management of the Company's cybersecurity program is led by a dedicated Director of IT. The Director of IT provides regular updates to the Company's senior management team through briefings on cybersecurity matters, including potential cybersecurity threats and incidents. This ensures that the highest levels of management are made aware of potential cybersecurity threats and any material cybersecurity matters are promptly escalated to the audit committee and Company's board of directors if necessary.


text: The Director of IT and senior management team provide quarterly reports, or more frequently as necessary, to the audit committee. These reports include updates on the Company's cybersecurity strategy, the status of projects to strengthen the Company's cybersecurity systems, and the emerging threat landscape. The audit committee reports to the Company's board of directors quarterly, or more frequently as necessary, regarding its activities, including those related to cybersecurity.


text: The Company has cybersecurity incident response policies and procedures for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. Our cybersecurity program is based on components of the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. The Company's Vice President, Information Security, who has 15 years of experience in information security and has several industry certifications such as Certified Information Security Manager ("CISM"), Certified in Risk and Information Systems Control ("CRISC"), and Certified Information Privacy Professional ("CIPP"), is primarily responsible for managing and assessing cybersecurity risks. The Company uses a number of other internal and external resources to manage its information technology ("IT") and cybersecurity operations across the Company, including global managed service providers that provide 24/7 support for all of the Company's key IT systems and consultants who are engaged periodically to assist with the Company's evaluation of its systems and processes for preventing and mitigating cybersecurity incidents. The Company's global managed service providers also assess cybersecurity incidents and classify them by severity level in accordance with the Company's Incident Response Plan, which determines how each cybersecurity incident is managed and communicated. The Incident Response Plan also outlines the procedures that the Company then follows for evaluation and recovery from an incident, including containment of the affected systems, in order to restore our systems to normal operations. To date, the Company has not had a cybersecurity event that materially impacted its operations, financial position or the security of its proprietary data.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK


text: Cybersecurity incidents that are deemed Priority 1 (described in the Incident Response Plan as those incidents affecting key operational and financial systems), are reported to certain members of the Company's Executive Leadership Team including the Chief Executive Officer, Chief Financial Officer, General Counsel and Chief Information Officer ("CIO") for assessment of the materiality of the incident, which will be made using both quantitative and qualitative analysis to determine an incident's immediate and reasonably likely future impacts. Cybersecurity incidents that are deemed material, either individually or in aggregate, are reported to the Audit Committee of the Company's Board of Directors, which has been delegated the responsibility for oversight of cybersecurity risks. The Company also communicates material cybersecurity incidents to the Company's independent auditors and internal audit team.


text: Annually the Company conducts an Enterprise Risk Assessment during which management identifies and quantifies risks to the Company's operations, financial position and strategy, including cybersecurity risks. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee. Working with the CIO and the Vice President, Information Security, the Audit Committee periodically reviews the strategy, priorities, and goals of the cybersecurity program and the CIO and Vice President, Information Security, provide regular updates to the Audit Committee.


text: The Company has cybersecurity incident response policies and procedures for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. Our cybersecurity program is based on components of the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. The Company's Vice President, Information Security, who has 19 years of experience in information security, including 8 years as a Chief Information Security Officer ("CISO"), and holds a post-graduate degree in a related field of study and is a Certified Information Systems Security Professional ("CISSP"), is primarily responsible for managing and assessing cybersecurity risks.


text: The Company uses a number of other internal and external resources to manage its information technology ("IT") and cybersecurity operations across the Company, including global managed service providers that provide 24/7 support for all of the Company's key IT systems and consultants who are engaged periodically to assist with the Company's evaluation of its systems and processes for preventing and mitigating cybersecurity incidents. The Company's global managed service providers also assess cybersecurity incidents and classify them by severity level in accordance with the Company's Incident Response Plan, which determines how each cybersecurity incident is managed and communicated. The Incident Response Plan also outlines the procedures that the Company then follows for evaluation and recovery from an incident, including containment of the affected systems, in order to restore our systems to normal operations. To date, the Company has not had a cybersecurity event that materially impacted its operations, financial position or the security of its proprietary data.


text: Risk management and strategy We have implemented and maintain a cybersecurity risk management program that includes information security processes designed to prevent, detect, remediate, and manage material risks from cybersecurity incidents and threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessment processes to monitor, evaluate and identify risks to our Information Systems and Data; • a multidisciplinary team, including members from our executive management team, our information security and technology function, and legal team (internal and engaged external experts) to identify, assess, and manage cybersecurity threats and risks; • security tools throughout our IT environment to monitor for and identify cybersecurity risks and incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • technical, physical, and organizational measures, processes, standards, and/or policies to address cybersecurity threats to our Information Systems and Data; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Our business could be adversely affected by security breaches through cyber-attacks, cyber intrusions or otherwise.", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Audit Committee of the Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity. The Audit Committee engages in regular discussions with management and engaged consultants and legal advisers regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.


text: Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. As described above, we also have engaged a third-party IT and cybersecurity firm that works closely with our management to implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Our management and information systems teams, oversee the work of our third-party IT and cybersecurity firm and regularly communicates with members of the team. Members of this third-party IT and cybersecurity team have collectively over 54 years of prior work experience and are responsible for the implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer. In addition, our Vice President, Information Systems, has 38 years of prior work experience in information systems and technology, including with respect to cybersecurity issues and threats.


text: Through the policies and controls described above, including our incident response policy, members of our management team, including our Chief Financial Officer, our Executive Vice President, Global Risk Management and our General Counsel, as well as representatives of the third-party IT and cybersecurity team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents.


text: Management, including the Vice President, Information Systems and Executive Vice President, Global Risk Management, serves on the Company's incident response team to help the Company address cybersecurity incidents. In addition, the Company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee holds quarterly meetings and receives periodic reports from management, including our Chief Financial Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also receives periodic reports from the Company's internal audit team with respect to regular network penetration and related tests to ensure that the Company's defense tools, processes and procedures are operating as designed.


text: Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. As described above, we also have engaged a third-party IT and cybersecurity firm that works closely with our management to implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Our management and information systems teams, oversee the work of our third-party IT and cybersecurity firm and regularly communicates with members of the team. Members of this third-party IT and cybersecurity team have collectively over 55 years of prior work experience and are responsible for the implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer. In addition, our Vice President, Information Systems, has 40 years of prior work experience in information systems and technology, including with respect to cybersecurity issues and threats.


text: Through the policies and controls described above, including our incident response policy, members of our management team, including our Chief Financial Officer, our Executive Vice President, Global Risk Management and our Executive Vice President, General Counsel, as well as representatives of the third-party IT and cybersecurity team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; violation of data privacy or cybersecurity laws and other litigation; legal and regulatory risk; and reputational risks. We have an enterprise-wide information security program designed to secure our technology infrastructure, networks, data, products and services, and we have implemented several processes, technologies and controls to aid in our efforts to identify, assess and manage related risks. Our Chief Information Security Officer ("CISO") manages this program, in collaboration with our business and corporate teams.

companyName: MSCI Inc.

ticker: MSCI


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management ("ERM") program considers cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term. In addition, our management-level Information and Technology Risk Oversight Committee ("ITROC"), led by our CISO, and including senior leaders such as our President and COO, CFO and General Counsel, among others, provides oversight relating to cybersecurity and technology-related risks that may present significant impacts to our operations, clients, reputation and financial position, and the considerations of the ITROC are fully incorporated into our overall ERM framework. Our CISO is also a member of the Company's Disclosure Committee and reports to the Disclosure Committee on a quarterly basis on any major cybersecurity incidents.


text: We also have cybersecurity specific policies, standards and procedures, and our cybersecurity program has been developed based on industry standards, including the U.S. National Institute of Standards and Technology ("NIST") cybersecurity framework and International Organization for Standardization ("ISO") information security standards. Our information security management system has achieved ISO 27001 certification. To provide for the resilience of critical data and systems, to maintain regulatory compliance, to manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we regularly undertake the below listed activities: •24x7x365 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;


text: • Regular internal and external security audits and penetration tests by third-party security vendors; • Testing of new products and services to identify potential security vulnerabilities before release; • Regular network and endpoint monitoring; • Periodic red- and purple-team assessments from third-party service providers; • Business resiliency planning with disaster recovery and business continuity testing; • Role-based access controls to identify, authenticate and authorize individuals to access systems based on their job responsibilities; • Protection, including encryption, for the secure communication of sensitive data; • Monitoring of emerging data protection laws and implementation of changes to our processes designed to comply therewith; • Regular review of policies and standards related to cybersecurity; • At least annual security awareness training and testing of our employees; • Regular review of critical third-party security practices; • Tabletop exercises to simulate a response to a cybersecurity incident and to use the findings to improve our processes and technologies; • A cross-functional approach to addressing cybersecurity risk, with participation from Technology, Risk, Legal, Compliance, Privacy and Internal Audit functions; and • Cybersecurity risk insurance to provide protection against potential losses arising from a cybersecurity incident.


text: Our IT risk program also includes an incident response plan that provides procedures for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors and other third parties, including by annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data or our systems. Cybersecurity considerations affect the selection and oversight of our third-party service providers. Although we perform diligence on third parties that have access to our systems, networks, data or facilities that house such systems, networks or data, and we monitor cybersecurity threat risks identified through such diligence, there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: In the last three fiscal years we have not identified any material cybersecurity incidents and have not identified any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the expenses we have incurred from any cybersecurity incidents over the last three fiscal years were immaterial. Furthermore, we have not been penalized or paid any amount under an information security breach settlement in the last three fiscal years. There can be no guarantee that we will not experience such an incident or incur such expenses in the future. For more information on our cybersecurity risks, see "Technology Risks" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors ("Board") and management.


text: The Audit and Risk Committee (the "Audit Committee") of our Board is responsible for the oversight of risks from cybersecurity threats. On a quarterly basis, our CISO updates the Audit Committee on the Company's IT risk program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics. This quarterly update is also made available to the full Board, and the Chair of the Audit Committee informs the Board of any key updates during quarterly reports to the Board. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during Board and Committee discussions of important matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters. The Board also conducts an annual education session on cybersecurity trends and risks.


text: Our cybersecurity risk management processes, which are discussed in greater detail above, are led by our CISO, who has over 20 years of work experience relating to cybersecurity, including at major financial institutions and consulting firms, involving the management of information security and the development of cybersecurity strategy, as well as relevant degrees and certifications, including holding a Bachelor of Science degree in Electrical and Computer Engineering. Our CISO oversees a team of approximately 50 professionals charged with the on-going management of our cybersecurity risk and strategy. These employees are informed about, and monitor the prevention, mitigation, detection, and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our ITROC, incident response plan and other processes. Our cybersecurity team includes managers that have expertise with cybersecurity, as demonstrated by prior work experience, possession of a cybersecurity certification or degrees or other cybersecurity experience. As detailed above, these members of management and management-level committees report to the Audit Committee about cybersecurity threat risks, among other cybersecurity-related matters, at least quarterly.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing and managing material cybersecurity risks, including, among other things, our operations; intellectual property theft; fraud; extortion; violation of data privacy or cybersecurity laws; legal and regulatory risk; and reputational risks. We have an enterprise-wide information security program designed to secure our technology infrastructure, networks, data, products and services, and we have implemented several processes, technologies and controls to aid in our efforts to identify, assess and manage related risks. Our Chief Information Security Officer ("CISO") manages this program, in collaboration with our business and corporate teams.


text: Cybersecurity risks are integrated into our enterprise risk management ("ERM") program, which evaluates cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term. In addition, our management-level Information and Technology Risk Oversight Committee ("ITROC"), led by our CISO, and including senior leaders such as our President and COO, CFO and General Counsel, among others, provides oversight relating to cybersecurity and technology-related risks that may present significant impacts to our operations, clients, reputation and financial position, and the considerations of the ITROC are fully incorporated into our overall ERM framework. Our CISO also provides updates to our Disclosure Committee on material cybersecurity incidents.


text: We also have cybersecurity-specific policies, standards and procedures, and our cybersecurity program aligns with industry standards, including the U.S. National Institute of Standards and Technology ("NIST") cybersecurity framework and International Organization for Standardization ("ISO") information security standards. Our information security management system has achieved ISO 27001:2022 certification. To help ensure the resilience of critical data and systems, maintain regulatory compliance, manage material cybersecurity risks, and protect against, detect and respond to cybersecurity incidents, we regularly undertake the following activities: •24x7x365 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;


text: Our IT risk program also includes an incident response plan that provides for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our brand and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data or our systems. Cybersecurity considerations affect the selection and oversight of our third-party service providers. Although we perform diligence on third parties and monitor cybersecurity threat risks identified through such diligence, we cannot guarantee that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties.


text: The Audit and Risk Committee (the "Audit Committee") of our Board is responsible for the oversight of risks from cybersecurity threats. On a quarterly basis, our CISO updates the Audit Committee on the Company's IT security program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics. This quarterly update is also made available to the full Board, and the Chair of the Audit Committee informs the Board of any key updates during quarterly reports to the Board. Material cybersecurity risks are also considered during Board and Committee discussions of matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters. The Board periodically conducts education sessions on cybersecurity trends and risks.


text: Our cybersecurity risk management processes, which are discussed in greater detail above, are led by our CISO, who has over 20 years of work experience relating to cybersecurity, including at major financial institutions and consulting firms, involving the management of information security and the development of cybersecurity strategy, as well as relevant degrees and certifications, including holding a Bachelor of Science degree in Electrical and Computer Engineering. Our CISO oversees a team of approximately 50 professionals charged with the ongoing management of our cybersecurity risk and strategy. These employees monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents, including through the operation of our ITROC, incident response plan and other processes. Our cybersecurity team includes managers that have expertise with cybersecurity, as demonstrated by prior work experience, possession of a cybersecurity certification or degrees or other cybersecurity experience.


text: First Guaranty and First Guaranty Bank recognize the importance of incorporating cybersecurity in the company's operations, reputation, and overall risk management frameworks. First Guaranty Bank manages cybersecurity for both the holding company First Guaranty Bancshares, Inc. and the bank subsidiary. The IT Steering Committee (ITSC), while reporting regularly to the full Bank Board of Directors (the "Bank Board"), has been delegated oversight to ensure appropriate cybersecurity risk management for risks that are inherent to our organization. These risk management strategies have been implemented into the organization's enterprise risk management frameworks and our Internal Audit Plan. This disclosure is intended to inform investors about cybersecurity risks, risk management strategies, and potential impacts on financial conditions and operations in line with SEC guidance.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: First Guaranty Bank's Chief Information Security Officer ("CISO") is primarily responsible for the development, monitoring, and implementation of the Information Security Program. The CISO, through direct interaction with the Chief Information Officer ("CIO"), works to manage cybersecurity risks and provide updates to the Bank Board. The CISO and CIO for First Guaranty Bank have over 30 years of combined cyber security experience and wealth of expertise. The CISO reports quarterly on cybersecurity metrics, key initiatives, and emerging risks that could affect the organization. In accordance with the Graham Leach Bliley Act, the Information Security Program was designed to include administrative, logical, and physical safeguards appropriate for the size and complexity of the organization. First Guaranty's Information Security program recognizes and is in alignment the Federal Financial Institutions Examination Council (FFIEC) standard for cybersecurity risk management and best practices.


text: First Guaranty assesses cybersecurity risk by identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information, information systems, or bank records. These risks are then classified and prioritized based on their residual risk level. The organization has a board-approved risk appetite of "low." Any risks with a residual risk above low are escalated to the board for oversight and a mitigation plan is developed to remediate the remaining residual risk.


text: First Guaranty has developed and implemented an Incident Response Plan (IRP). The IRP establishes a framework for the information security team to identify, classify, notify, contain, eradicate, and recover from cybersecurity related incidents. Testing of the IRP is conducted annually.


text: First Guaranty engages third-party services to conduct penetration testing as well as regular evaluations of security protocols and processes. Furthermore, First Guaranty has implemented a vendor risk management program that includes a thorough vendor review and information security assessment of the vendor's security controls, policies, and procedures prior to onboarding. Ongoing and regular monitoring of third parties is managed through the vendor management, enterprise risk management, Information Security, and internal audit departments.


text: First Guaranty's Information Security and Learning and Development departments facilitate annual company-wide security awareness training, regular phishing exercises, and provide regular updates across the organization to keep employees informed on ways to mitigate cybersecurity risk. Information Security has developed and distributed a procedure to inform its employees how to escalate potential cybersecurity risks.


text: As of the date of this Form 10-K, the organization is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect First Guaranty. For more information on how cybersecurity risk may materially affect the organization, please refer to Item 1A Risk Factors.


text: The foundation of our cybersecurity program is based on the International Organization for Standardization (ISO) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.

companyName: Fabrinet

ticker: FN


text: Our VP of Information Technology and Information Security ("VP of IT/IS"), who reports to our Chief Executive Officer, manages our cybersecurity and information security risk assessment and mitigation process. We have established an internal IT security committee that includes our VP of IT/IS and other members of our information security, information technology, internal audit/compliance, and finance teams, to instill a thoughtful security culture across Fabrinet. Our employees are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We deploy multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.


text: We have not experienced a material security breach in our systems, or, to our knowledge, in our third-parties' systems, nor incurred any significant expenses or penalties to resolve or settle any security breach in the past three years.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors—Intellectual Property and Cybersecurity Risks," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee of the board of directors, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews our cybersecurity and information security risks and mitigation strategies. Our VP of IT/IS provides briefings to the audit committee on a quarterly or more often basis as needed regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like.


text: Our VP of IT/IS is a Certified Information Security Manager (CISM) and has more than 9 years of experience implementing cybersecurity at technology companies. Our VP of IT/IS, together with our internal IT security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to the chair of the audit committee, among others as needed, to manage our response.


text: Our VP of IT/IS is a Certified Information Security Manager (CISM) and has more than 10 years of experience implementing cybersecurity at technology companies. Our VP of IT/IS, together with our internal IT security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity governance program intended to assess, identify, and manage risks from threats to the security of our information, systems, and network. Our risk-based measures aim to proactively manage threats and prove the effectiveness of our internal controls.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our cybersecurity governance program adopted the Center for Internet Security Critical Security Framework as the structure to help detect and mitigate threats through risk-based controls designed to protect Titan Machinery's information, systems, and network.


text: We continuously review and seek to enhance our program as risks evolve and compliance requirements change. We use our internal security team and engage third-party cybersecurity companies. Together we conduct periodical assessments and ongoing enhancements to our cybersecurity posture and identify and remediate risks from cyber threats. The assessment includes reviewing third-party service providers periodically and before new engagements.


text: Security awareness training is provided to educate employees about cybersecurity threats and help them understand their responsibility in identifying, mitigating, and reporting security concerns or threats. Along with other significant risks for the Company, we have sought to integrate cybersecurity into our enterprise risk management framework, by tracking key risk indicators, emerging risks and changes to the risk mitigation plan to achieve desired results.


text: Cybersecurity Governance The Board is aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is responsible for board-level oversight of cybersecurity risk. The Audit Committee reports back to the full Board about cybersecurity and other areas within their responsibility.


text: Our cybersecurity governance program is led by our Vice President of Information Technology ("VP of IT"). The VP of IT is informed about and monitors the prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the security team. Our VP of IT has been assessing and managing cybersecurity risk for the company since 2015. In total, our VP of IT has over 20 years of IT industry experience in various roles.


text: Team members who support our cybersecurity governance program have relevant education and industry experience. The team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: Our VP of IT semi-annually and on an ad-hoc basis presents directly to the Audit Committee on cybersecurity initiatives, efforts, and security risks. The Audit Committee reports to the Board at minimum semi-annually the cybersecurity initiatives, efforts and security risks. In addition, we have an Incident Response Policy in place to inform senior management and the Board of material issues related to cybersecurity matters and to develop an appropriate response plan.


text: While we have experienced cybersecurity incidents in the past, to date, none have materially impacted the Company or our financial position, results of operations and/or cash flows. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Security breaches and other disruptions could compromise our information systems and expose us to liability, which would cause our business and reputation to suffer."


text: Cybersecurity Governance The Board is aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is responsible for board-level oversight of cybersecurity risks. The Audit Committee reports back to the full Board about cybersecurity and other areas within their responsibility.


text: O ur cybersecurity governance program is led by our Vice President of Information Technology ("VP of IT"). The VP of IT is informed about and monitors the prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the security team. Our VP of IT has been assessing and managing cybersecurity risk for the Company since 2015. In total, our VP of IT has over 20 years of IT industry experience in various roles. Our cybersecurity security team includes a dedicated manager with over 15 years of experience, that reports directly to our VP of IT, to help manage cybersecurity risks for the Company.


text: Team members who support our cybersecurity governance program have relevant education and industry experience. This team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: Our VP of IT semi-annually and on an ad hoc basis presents directly to the Audit Committee on cybersecurity initiatives, efforts, and security risks. The Audit Committee reports to the Board at least semi-annually on our cybersecurity initiatives, efforts and security risks. In addition, we have an Incident Response Policy in place to inform senior management and the Board of material issues related to cybersecurity matters and to develop an appropriate response plan.


text: While we have experienced cybersecurity incidents in the past, based upon the information that we have as of the end of fiscal 2025, we are not aware of any cybersecurity incident that has materially affected or that is reasonably likely to materially affect our business' financial position or results of operations. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurances that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially impact us. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Risks Related to Data Security."


text: Cybersecurity represents a critical component of our overall approach to risk management. Accordingly, cybersecurity risks are subject to oversight by the Company's Board of Directors (the Board), primary responsibility for which has been delegated by the Board to its Operational Risk Committee (the Board Operational Risk Committee).

companyName: LendingClub Corp

ticker: LC


text: Our cybersecurity policies, processes and practices are informed by the cybersecurity framework established by the National Institute of Standards and Technology. We are able to leverage a cross-functional team that includes senior personnel from our technology, operations, legal, risk management and internal audit functions as and when warranted by the particular cybersecurity matter. In managing cybersecurity risks, we strive to: (i) identify, prevent and mitigate cybersecurity threats; (ii) preserve the confidentiality, security and availability of proprietary or confidential information; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our members, marketplace investors and business partners; and (v) provide appropriate and required disclosure of cybersecurity risks and incidents.


text: Risk Management and Strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats are fully integrated into our enterprise risk management (ERM) program and include the following areas of focus: • Systems Safeguards: Preventing and mitigating cybersecurity threats, including through the use of firewalls, intrusion prevention and detection systems, anti-malware software, access controls and other system safeguards. • Incident Response: Identifying and responding to cybersecurity incidents in accordance with our information security incident response plan. • Collaboration: Collaborating internally and with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: Maintaining a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems. • Training: Reinforcing our information security policies, processes and practices through periodic mandatory training for Company personnel. • Governance: Designing a comprehensive framework for the oversight of cybersecurity risk, with regular interaction between the Board Operational Risk Committee and the Company's ERM function, our Chief Information Security Officer (CISO) and members of Company management and relevant management committees, including the Company's Management Operational Risk Committee (the Management Operational Risk Committee).


text: A key part of our strategy for managing risks from cybersecurity threats is the assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability scanning and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties to perform assessments on our cybersecurity measures, including information security penetration tests, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board Operational Risk Committee and are used to adjust our cybersecurity policies, standards, processes and practices, as necessary.


text: The Board Operational Risk Committee oversees the management of risks from cybersecurity threats, including policies, processes and practices implemented by Company management to address such risks. The Board Operational Risk Committee receives presentations and reports on cybersecurity risks and information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates until such incident has been addressed. At least once each year, the Board Operational Risk Committee discusses the Company's approach to cybersecurity risk management with our CISO. Further, the Board periodically, as warranted, receives reports with respect to and engages in discussions with Company management on cybersecurity matters.


text: Our CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other senior personnel across the Company. Our CISO works in coordination with the other members of the Company's Management Operational Risk Committee, which includes our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, Chief Risk Officer and General Counsel. Our CISO has served in that role for over 5 years and in various roles in information technology and information security for over 20 years. Our CISO holds an undergraduate degree in computer information systems and has attained the professional certification of Certified Information Systems Security Professional. The other members of the Management Operational Risk Committee each have relevant qualifications and over 10 years of experience managing risk in the technology and/or financial services industry.


text: Our CISO, in coordination with the Management Operational Risk Committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, cross-functional teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our information security incident response plan. Our CISO, through his team and use of accompanying technology, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Management Operational Risk Committee and/or the Board Operational Risk Committee, as and when appropriate.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents of a material nature. For additional information about the risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Annual Report.


text: Our CISO, in coordination with the Management Operational Risk Committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, cross-functional teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our information security incident response plan. Our CISO, through his team and use of accompanying technology, monitors the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Management Operational Risk Committee and/or the Board Operational Risk Committee, as and when appropriate.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents of a material nature. For additional information about the risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Annual Report.


text: As a provider of SaaS solutions and an extensive user of a variety of technology services, we are subject to numerous risks from cybersecurity threats that have and could adversely affect us; however, to date none have materially affected us or our business strategy, results of operation or financial condition. Cybersecurity threats are ever-present and continuously evolving and we have and will continue to expend considerable resources to deliver solutions that are designed to comply with the stringent security and technical regulations and practices applicable to financial institutions and financial services providers and to safeguard our solutions and information systems against cybersecurity threats. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors." We have implemented a risk-based approach to identify and assess the cybersecurity threats that have and could affect our business and information systems, which approach is incorporated into our overall enterprise risk management program. Our enterprise risk management program includes a formal, enterprise-wide inventory, categorization and assessment of risks, including risks associated with cybersecurity threats, overseen by the Risk and Compliance Committee, or RACC, of our Board of Directors, and managed by our dedicated Chief Risk Officer, or CRO, and an Enterprise Risk Oversight Committee consisting of a cross-functional representation of senior leaders including our Chief Information Security Officer, or CISO. Our CRO has over eight years of senior risk management experience at large technology organizations, following a 20-year career in the U.S. Army. Our enterprise risk management team works in partnership with our dedicated security, information technology, compliance, internal audit, and third-party risk management functions, which collectively rely on a variety of internal resources and processes, as well as third-party consultants, auditors and applications, to identify, assess and manage cybersecurity risks, including cybersecurity threats related to third-party providers on which we rely. Our enterprise risk management function also extensively consults with senior management across our organization in identifying, assessing and managing risks.

companyName: Q2 Holdings, Inc.

ticker: QTWO


text: Our information security program is managed by a dedicated CISO, whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CISO has more than 20 years of experience directing disparate teams across application and product security, cyber defense, risk management, information governance, information technology compliance, information technology training and sales. Our CISO is appointed by the RACC, which also oversees the implementation, monitoring and testing of our information security program. Our CISO and CRO provide periodic reports to the RACC, at least quarterly. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security posture, assessments of the information security program, and the emerging threat landscape. Our CISO and CRO also regularly meet separately with the chair of the RACC to provide similar updates. Our information security program includes incident response procedures designed to facilitate escalation of actual or potential cybersecurity incidents initially to members of our security team, and as appropriate to senior management and the RACC, to allow proper consideration, mitigation and remediation of, as well as evaluation of potential disclosure obligations with respect to, actual or potential cybersecurity incidents. Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the RACC. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.


text: As a provider of SaaS solutions and an extensive user of a variety of technology services, we are subject to numerous risks from cybersecurity threats that have and could adversely affect us; however, to date none have materially affected us or our business strategy, results of operation or financial condition. Cybersecurity threats are ever-present and continuously evolving and we have and will continue to expend considerable resources to deliver solutions that are designed to comply with the stringent security and technical regulations and practices applicable to financial institutions and financial services providers and to safeguard our solutions and information systems against cybersecurity threats. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors." We have implemented a risk-based approach to identify and assess the cybersecurity threats that have and could affect our business and information systems, which approach is incorporated into our overall enterprise risk management program. Our enterprise risk management program includes a formal, enterprise-wide inventory, categorization and assessment of risks, including risks associated with cybersecurity threats, overseen by the Risk and Compliance Committee, or RACC, of our Board of Directors. This program is managed by our Chief Risk Officer, or CRO, appointed by the RACC, and an Enterprise Risk Oversight Committee consisting of a cross-functional representation of senior leaders including our Chief Information Security Officer, or CISO. Our CRO has over nine years of senior risk management experience at large technology organizations, following a 20-year career in the U.S. Army. Our enterprise risk management team works in partnership with our security, information technology, compliance, internal audit, and third-party risk management functions, which collectively rely on a variety of internal resources and processes, as well as third-party consultants, auditors and applications, to identify, assess and manage cybersecurity risks, including cybersecurity threats related to third-party providers on which we rely. Our enterprise risk management function also extensively consults with senior management across our organization in identifying, assessing and managing risks.


text: Our information security program is managed by a CISO, whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CISO has more than 20 years of experience directing disparate teams across application and product security, cyber defense, risk management, information governance, information technology compliance, information technology training and sales. Our CISO is appointed by the RACC, which also oversees the implementation, monitoring and testing of our information security program. Our CISO and CRO provide periodic reports to the RACC, at least quarterly. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security posture, assessments of the information security program, and the emerging threat landscape. Our CISO and CRO also regularly meet separately with the chair of the RACC to provide similar updates. Our information security program includes incident response procedures designed to facilitate escalation of actual or potential cybersecurity incidents initially to members of our security team, and as appropriate to senior management and the RACC, to allow proper consideration, mitigation and remediation of, as well as evaluation of potential disclosure obligations with respect to, actual or potential cybersecurity incidents. Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the RACC. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.


text: Cybersecurity Risk Management and Strategy To effectively prevent, detect and respond to cybersecurity threats, we maintain a cyber risk management program under the responsibility of the head of the Information Technology ("IT") function. Management and administration of cybersecurity systems and activities are primarily outsourced to consultants who have cross-functional expertise in cyber security and who perform the work under the supervision of the IT head. Our IT head, in turn reports to the Senior Vice-President and General Counsel who is responsible for and knowledgeable of legal and contractual cybersecurity risk for the organization. The program is comprised of policies, standards, architecture, and processes, which are reviewed and updated on a periodic basis. The program leverages a multilayered approach of utilizing different practices, technologies, vendors or techniques without an overreliance on a single vendor. We engage with consultants to help develop and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements, and also evaluate and adopt cybersecurity software from reputable vendors in cybersecurity, some that provide software as a service solutions backed by a Security Operations Center. We also engage separate third parties to provide penetration testing, risk consulting, cybersecurity incident assessment and forensics, as necessary and in addition to IT's internal risk assessment processes. We work with many companies that provide hosted software or support for software systems. It is important for these companies to also have effective cybersecurity measures to protect data and systems. We have a self-attestation form to assess cybersecurity readiness that is sent to select vendors based on a risk assessment. For certain vendors, we request System and Organization Controls (SOC) reports or similar documents to provide assurance that the vendors have audited practices or practices in keeping with our legal requirements even if SOC audit documentation does not exist. We have also engaged legal counsel to advise on cybersecurity matters and we have developed an escalation protocol to report cybersecurity incidents as legally required. No material cybersecurity incidents have occurred to date.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: The program also includes training that reinforces our policies, standards, and practices, as well as the expectation that employees comply with these policies. The training engages personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. We maintain a cybersecurity risk insurance policy.


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. IT provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. IT also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the Center for Internet Security (CIS) control objectives and benchmarks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS objectives and benchmarks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: cybersecurity awareness training and communications for employees;


text: a dedicated security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity controls to detect cybersecurity incidents or risks within our IT Systems;


text: internal and external risk assessments designed to help identify material cybersecurity risks to our critical systems and information; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our network may be the target of potential cyber-attacks and other security breaches that could have significant negative consequences."


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Engineer in our Information Technology department who reports directly to the CIO. Our Cybersecurity Engineer is primarily responsible for continuously evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Engineer and the Information Technology team are responsible for the day to day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Engineer is a certified information systems security professional by the International Information System Security Certification Consortium, and his experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Cybersecurity Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 36 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelors degree in computer science and service as the Company's CISO for the past nine years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business, as well as the risks associated with the Company's business, identification of areas inside and outside of the Company that expose it to cybersecurity threats, and employing policies, systems and safeguards to manage those cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: The Company's Internal Audit Department further assists the Company to ensure that the proper safeguards are in place to protect the Company's information by conducting internal audits on certain aspects of the information security program. Internal Audit engages professionals that specialize in information security to review and provide an annual examination and report on the sufficiency of the Company's cybersecurity process and information security program. The Company's independent public accounting firm also performs audit procedures regarding the information security program. In addition, the Company's and the Bank's regulators review and assess the Company's information security program on an annual basis.


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and a representative from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.