text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the " Executive Risk Committee "), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, risks affecting the Company are identified. For 2024, cybersecurity was identified as a risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. Cybersecurity in Caterpillar's 2023 Annual Report on Form 10-K filed separately with the Securities and Exchange Commission.

companyName: CATERPILLAR FINANCIAL SERVICES CORP

secItem: Item 1C


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs, and others. We also consume threat intelligence from several paid and non-paid sources.


text: As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Item 1A. "Risk Factors—Operational Risks— Increased information technology security threats and more sophisticated computer crime pose a risk to our systems, networks, products and services" of this Form 10-K, these threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in Caterpillar products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.


text: Caterpillar's board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the Caterpillar board. Caterpillar's board has delegated the oversight of specific risks to board committees that align with their functional responsibilities. Caterpillar's Audit Committee (the "Caterpillar AC") assists the Caterpillar board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, Caterpillar's information security program. The Caterpillar AC assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Caterpillar's Chief Information Officer & Senior Vice President, Caterpillar IT (the "Caterpillar CIO") attends all bimonthly Caterpillar AC meetings and provides cybersecurity updates to the Caterpillar AC and Caterpillar board.


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly twenty-five years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Cat Financial Cybersecurity Governance Our Risk Committee provides oversight over our information security program and other matters related to cybersecurity. Our President serves as the chair of this committee, which includes among its members our Chief Risk Officer and our Chief Information Officer. Our cybersecurity program is managed by our Chief Information Security Officer, who reports on a regular basis to our Risk Committee on cybersecurity matters and who regularly collaborates with the Caterpillar cybersecurity team.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. "Cybersecurity" in Caterpillar's Annual Report on Form 10-K for the year ended December 31, 2024 filed separately with the SEC.


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs and others. We also consume threat intelligence from several paid and non-paid sources.


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly-owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly 25 years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Risk Management & Strategy: The Company is committed to maintaining strong and meaningful privacy and security protections for our customers' information by making available sufficient human and financial resources to protect against and monitor cybersecurity threats. These threats have increased as the use of technology has proliferated in our core business. Examples include internet banking, mobile banking, remote deposit capture, work from home accommodations, and advance function ATMs.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and is a participant in the Federal Financial Institutions Examination Council (FFFIEC) Cybersecurity Assessment Tool. Information security training is required for all employees no less than annually.


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency (OCC).


text: Included in our mitigation strategy is a comprehensive cybersecurity insurance policy. The Board and Management recognize that cybersecurity matters, including expenditure related threats and the impact of incursions or breaches, may trigger disclosure requirements under SEC rules and regulations, and intend to remain vigilant with respect to the cybersecurity aspects of these obligations.


text: Neither the Bank nor the Company have experienced any information security breaches of its systems in the past five years. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our cybersecurity risk management processes, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity risks that we face.


text: Governance: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer (CIO) who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst (CA) who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee (TSC) where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management (ERM) Committee where membership includes the CIO, senior level managers, and a represent from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and is a participant in the Federal Financial Institutions Examination Council ("FFFIEC") Cybersecurity Assessment Tool ("CAT"). The Bank has plans to move to a new cybersecurity assessment tool in 2025 as the FFIEC is sunsetting the CAT. Information security training is required for all employees no less than annually.


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency ("OCC").


text: Governance: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer ("CIO") who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst ("CA") who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee ("TSC") where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management ("ERM") Committee where membership includes the CIO, senior level managers, and a representative from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.


text: Air Group's management and Board consider cybersecurity to be a critical component of the Company's risk management plan. Our systems are subject to increasing and evolving cybersecurity risks. Unauthorized parties have attempted and continue to attempt to gain access to our systems and information, including through fraudulent misrepresentation and other means of deception. The systems of our suppliers, vendors, and other business partners are also at risk. The threat of cybersecurity incidents is included within our company's annual enterprise risk management (ERM) program that assesses the most significant risks to the enterprise.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Because of the industry in which we operate, we are subject to extensive regulatory requirements connected to cybersecurity, including but not limited to those overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and is comprised of individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.


text: As part of our annual review of our cybersecurity risk management, we engage third-parties for a variety of processes including external audits, vulnerability assessments, and penetration tests. These processes help ensure our overarching strategy remains effective over time.


text: The Board of Directors is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.


text: Because of the industry in which we operate, we are subject to extensive cybersecurity regulation, including but not limited to those regulations overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and comprises individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.


text: The Board of Directors of Alaska Air Group is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.


text: Our information technology networks, those of our operators and managers, and those of third parties on whom we rely, are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: WELLTOWER INC.

ticker: WELL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and penetration testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.


text: The Board of Directors (the "Board") retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. The Board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness, and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee receives a cybersecurity report from management. This report may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each report are determined based on current priorities and emerging issues in cybersecurity. The Audit Committee and management also report to the Board at least annually on data protection and cybersecurity matters.


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Chief Technology Officer, with extensive cybersecurity knowledge and skills from over 20 years of relevant work experience at Welltower and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, many having held similar positions with responsibility for various aspects of cybersecurity at large organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. The Chief Technology Officer also leads our Cyber Security Working Group, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. The Chief Technology Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: Information Security Program The information security team provides regular reports to the Chief Technology Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices informed by the National Institute of Standards and Technology ("NIST"), including the NIST Cybersecurity Framework.


text: To ensure that cybersecurity is an organization-wide effort, we provide mandatory cybersecurity training at least annually for all employees with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.


text: Incident Response The Cybersecurity Working Group maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents, that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Cybersecurity incidents could disrupt our business and result in the loss of confidential information and legal liability," which should be read in conjunction with the foregoing information.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and penetration testing. Additionally, we conduct regular evaluations of our cybersecurity program, which may include internal reviews and third-party assessments to validates the program's effectiveness and resilience.


text: The Board of Directors (the "Board") retains ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. The Board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee receives a cybersecurity report from the Chief Technology Officer and the information security team. This report may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each report are determined based on current priorities and emerging issues in cybersecurity. The Audit Committee, along with the Chief Technology Officer and the information security team, also report to the Board at least annually on data protection and cybersecurity matters.


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Chief Technology Officer, with extensive cybersecurity knowledge and skills from years of relevant work experience at Welltower and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This information security team comprises individuals with relevant educational and technical experience, many having held similar positions with responsibility for various aspects of cybersecurity at large organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. The Chief Technology Officer also leads our Cyber Security Working Group, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. The Chief Technology Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee and Board.


text: We provide mandatory cybersecurity training at least annually to our personnel with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. These systems and processes are designed to the third party's risk level and may include, for example, conducting upfront diligence of the third party's certifications and security program, using contractual provisions that address cybersecurity risks and conducting additional monitoring of the third party's security practices. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure. However, our insurance coverage may not sufficiently cover all types of losses or claims that arise or be subject to exclusions.


text: Incident Response The Cybersecurity Working Group maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident and is designed to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders (including the Board for certain incidents) informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by an incident and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive, or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us within the prior fiscal year, there can be no guarantee that we will not be the subject of future attacks, threats or incidents, that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Cybersecurity incidents could disrupt our business and result in the loss of confidential information and legal liability," which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy We have taken critical steps to ensure the security and protection of our computer systems and networks. Our processes for assessment, identification and management of material risks from cybersecurity threats include routine monitoring of vulnerabilities, evaluations of new service providers, written policies for incident identification and management, and regular testing and assessment of our cybersecurity posture.

companyName: H2O AMERICA

ticker: HTO


text: We have integrated cybersecurity risk management as part of our company-wide culture. The measures undertaken include, but are not limited to, monthly cybersecurity training for all employees and frequent communication to all employees on the importance of cybersecurity measures.


text: We have engaged third-party experts to assist us in monitoring and managing our cybersecurity process. Furthermore, we monitor cybersecurity threats at certain of our third-party vendors on a regular basis. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations, or financial condition. We have discussed cybersecurity risks that may affect the company in Item 1A, "Risk Factors," under the headings, "The necessity for ongoing physical and technological security has resulted, and may continue to result, in increased operating costs," "Water Utility Services rely on information technology and systems that are key to business operations. A system malfunction, security breach, cyber-attacks or other disruption that compromises our information and expose us to liability and adversely affect business operations. In addition, noncompliance could expose us to liability and adversely affect business operations," and "We may not be able to maintain adequate insurance coverage at reasonable costs, or at all, to cover all losses incurred in our operations."


text: Cybersecurity Governance We have implemented an internal risk assessment process that focuses on the principal risks that have been identified for us, including risks associated with our regulatory environment, business operations and continuity, compliance requirements, information technology and data storage and retrieval facilities, cyber risk, insurance coverage. The Audit Committee, pursuant to its charter, meets at least quarterly with senior leadership and other employees to discuss identified risks and the measures taken to control, manage and mitigate those risks, which include cyber and information security risk. On the basis of these meetings and discussions regarding such risks, the Chairman of the Audit Committee reports periodically to the full Board. The Vice President, Information Security Officer provides cybersecurity updates to the Audit Committee and other members of our senior management as appropriate at least quarterly. Our Vice President, Information Security Officer, and his team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, with the support of third-party experts. The Vice President, Information Security Officer has over 30 years of experience in information technology of which over 20 years is in cybersecurity, with industry experience in utilities, banking and e-commerce.


text: Risk Management and Strategy The Company has developed an information security program for assessing, identifying and managing material risks from cybersecurity threats. The program includes policies and procedures that govern how the Company's security measures and controls are developed, implemented, and maintained. The Company conducts a cybersecurity risk assessment, based on a method and guidance from a recognized national standards organization, at least annually. The Company selects the security controls it uses to address cybersecurity risks based on its annual risk assessment, additional risk-based analysis performed by the Company and its evaluation of various factors, including the likelihood and severity of risk, the impact on the Company and others if a risk materializes, the feasibility and cost of controls, and the impact of controls on operations and others. Security controls used by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: The Company engages third-party security firms to provide or operate some of these security controls and technology systems. For example, third parties conduct assessments such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and periodically conducts tabletop exercises to enhance incident response preparedness. The Company also maintains business continuity and disaster recovery plans to prepare for a potential disruption in technology. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and at least semi-annually thereafter.


text: The Company has an Enterprise Risk Management (ERM) function to address enterprise risks, including cybersecurity. ERM is led by our Enterprise Risk Council, which consists of members of the CEO's staff. The Risk Council oversees the design and execution of the ERM function to allow for the identification, assessment, prioritization, management, monitoring and reporting of material risks. This includes an annual risk assessment and quarterly updates of the risk profile given current operating conditions. The Risk Council meets quarterly and provides reporting to the Board of Directors and relevant Board Committees given the nature of specific risks identified, which includes cybersecurity risk.


text: The Company may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls we implement and it is possible that we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Governance.


text: Our Chief Information Security Officer (CISO) has primary responsibility for the development, operation, and maintenance of our information security program, including assessing and managing risk from cybersecurity threats. The Company's CISO has 30 years of information technology experience, with 17 years focused specifically on information security and risk management. He combines organizational management and leadership skills with a high degree of technical knowledge, the result of hands-on information technology and security experience.


text: The CISO provides regular security updates to key members of our management team, quarterly Audit Committee briefings, and ad-hoc security updates if a situation requires. Security Risk Assessment results are provided to both the Enterprise Risk Council as well as the Audit Committee as part of the quarterly briefings. The Board of Directors has delegated oversight of the information security program to the Audit Committee.


text: The Company is not aware of any cybersecurity threat or any material cybersecurity data breach to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, harm to our candidates, associates, employees and clients; operational disruptions; violation of privacy laws and regulations; breach of confidentiality and other contractual obligations; litigation and legal action; financial and reputational harm. We leverage cybersecurity technologies and established processes, procedures, and controls to identify, assess, and manage material cybersecurity risks.

companyName: TrueBlue, Inc.

ticker: TBI


text: Risk assessments Our Information Security Team, led by our Chief Information Security Officer ("CISO"), consists of a Cybersecurity function and a Governance, Risk and Compliance function, and is constantly monitoring for cybersecurity risks and assessing any such risks' potential severity. This team employs a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute an annual enterprise risk management assessment, which includes cybersecurity threat risks in addition to other risk areas that could impact the company.


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In September 2021, we received our ISO 27001 Information Security Management certification. In fiscal 2022 and 2023, management performed procedures to validate our continued conformity with the ISO 27001 standard and concluded that existing controls continued to operate effectively. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Monitor emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct regular phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.


text: Incident response Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident and coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including periodic third-party reviews of our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Third-party risk management Our polices and processes address cybersecurity threat risks associated with the use of third-party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.


text: Additional information We describe how the risks related to cybersecurity could materially impact our business strategy, results of operations, or financial condition, in more detail under the heading "Risks Related to Cybersecurity, Data Privacy and Information Security," see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: In the last three fiscal years, we have not experienced any cybersecurity incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations, or financial condition.


text: CYBERSECURITY GOVERNANCE Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Technology Officer ("CTO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CTO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.


text: Our cybersecurity risk management and strategy processes are led by our CTO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In 2024, we recertified our ISO 27001 Information Security Management certification to the new 2022 standard. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Collaborate with the legal department for awareness of emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct monthly phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Send periodic company-wide communications to raise employee awareness of social engineering and other forms of attack and how to guard against those; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Digital Officer ("CDO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CDO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.


text: Our cybersecurity risk management and strategy processes are led by our CDO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Risk Management and Strategy Autodesk has established policies and processes for assessing, treating, and managing material risk from cybersecurity threats based on relevant industry standards. These policies and processes are reviewed and updated at least annually. We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may adversely affect the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Autodesk, Inc.

ticker: ADSK


text: We conduct risk assessments, penetration tests, and other security assessments to identify cybersecurity threats regularly, and in the event of a material change in our business practices that may affect information systems potentially vulnerable to such cybersecurity threats. These assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Risks are then assigned to the appropriate owners for tracking and mitigation.


text: Following these assessments, we re-design, implement, and maintain reasonable safeguards, when appropriate, to minimize identified risks; reasonably address any identified gaps in existing safeguards; and continually monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Trust Officer, who reports to our Chief Technology Officer, to manage the risk assessment and mitigation processes.


text: As part of our overall risk management system, we monitor and test our safeguards. We train our workforce on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required trainings. Cybersecurity tabletop exercises are regularly conducted for our executives and for incident response professionals. Improvements identified at these tabletop exercises are implemented into our processes.


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These outside advisors assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require Autodesk's third-party service providers and suppliers to implement and maintain appropriate security measures consistent with applicable laws in connection with their work with us and to promptly report any suspected breach of their security measures that may affect our Company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Relating to Our Operations".


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. The board's Audit Committee oversees the management of cybersecurity risks relating to financial, accounting, and internal control matters. The full board receives regular updates from our senior management and outside advisors regarding cybersecurity risks Autodesk faces. Our Enterprise Risk Management function is responsible for identifying, prioritizing, and mitigating risks that could limit Autodesk's achievement of its strategic and operational priorities. Our executive officers are responsible for the day-to-day assessment and management of these risks.


text: Our Chief Trust Officer is responsible for assessing and managing material risks from cybersecurity threats. Our Chief Trust Officer has more than twenty years of cybersecurity leadership experience, including serving in similar roles leading cybersecurity programs at other public companies.


text: Our Chief Trust Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Trust Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: leading Autodesk's Trust program which implements data protection measures and processes across the organization; strategic planning of the company's cybersecurity initiatives and objectives; cybersecurity risk mitigation efforts; managing tools and processes that support security incident monitoring and alerting; overseeing security incident response planning; managing exercises that test management's response plans and procedures; and managing our response to suspected or actual security incidents.


text: Our Chief Trust Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and state of our Trust program, including recent cybersecurity incidents and related responses, cybersecurity systems testing, and data protection initiatives and metrics. Our Audit Committee regularly updates the board of directors on such reports. In addition, our Chief Trust Officer provides briefings on cybersecurity risks and activities to the board of directors at least annually. Our Chief Trust Officer may also brief the board of directors regarding significant cybersecurity incidents.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors under the heading "Risks Relating to Our Operations".


text: Risk Management and Strategy The company maintains a cybersecurity risk management program as part of its overall risk management framework and regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the company's cybersecurity standards, processes, and practices. To protect the company's information systems from cybersecurity threats, the company uses various security tools that help the company identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include but are not limited to, internal reporting, engaging third-party service providers to actively monitor information systems, performing vulnerability testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging trends and regulations related to information security, and implementing appropriate changes, as needed, to our cybersecurity risk management program.

companyName: MIDDLEBY Corp

ticker: MIDD


text: The company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These assessments include penetration testing, vulnerability assessments, tabletop exercises, and reviews of incident response protocols that are designed to ensure robust protections against evolving threats.


text: The company has processes that aim to validate security controls and engages third parties to design or assess security architecture, and certifications. This includes assessing the potential fourth-party risks related to employee, business, and customer data. During the third-party procurement and contracting process, the company incorporates contract provisions that are designed to align with applicable regulations and industry benchmarks.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "The Company may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect the Company's operations, financial condition and operating results" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the company dedicates significant resources in an effort to secure its confidential information as well as the data and any personal information the Company receives and stores about its customers and employees. The company has systems in place designed to securely receive and store that information and to detect, contain, and respond to data security incidents.


text: The company has a robust information security training and compliance program for all new and existing employees. Training is provided at least annually, with a formal communication cadence of additional components of training being provided throughout the year. Employee cybersecurity proficiency is assessed quarterly, with supplementary training programs tailored to individual needs based on these evaluations. The company has not experienced a material cybersecurity or information security breach in the last three years.


text: The company maintains a program, run by the company's Director of Information Technology, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The company's Director of Global Information Technology is responsible for leading the assessment and management of cybersecurity risks. The current Director of Global Information Technology has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Director of Global Information Technology reports to the Audit Committee and management on cybersecurity threats on a regular basis.


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Director of Global Information Technology or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.


text: The company maintains a program, run by the company's Vice President of Global Information Technology and Information Security, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The company's Vice President of Global Information Technology and Information Security is responsible for leading the assessment and management of cybersecurity risks. The current Vice President of Global Information Technology and Information Security has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Vice President of Global Information Technology and Information Security reports to the Audit Committee and management on cybersecurity threats on a regular basis.


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Vice President of Global Information Technology and Information Security or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.


text: The Board of Directors' overall risk oversight function includes receiving reports on the Company's cybersecurity risks and our risk management processes, and assessing whether our risk management strategies are reasonably designed to address such risks. The Board has delegated this oversight responsibility to our Audit Committee, which reports periodically to the Board as appropriate.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Our Senior Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Senior Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.


text: Our Director of Information Security meets with the Audit Committee at least twice a year to discuss our cybersecurity risks, strategy, and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, we have governance and compliance structures that are designed to elevate issues relating to cybersecurity to executive o cers, and, as appropriate, to the Audit Committee and Board.


text: Cybersecurity risk management and strategy We have policies and processes in place that are designed to assess, identify and manage material risks from cybersecurity threats. We regularly assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We use recognized industry frameworks and standards as guides in identifying, assessing and managing cybersecurity risks relevant to our operations. For example, we primarily use NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) for this purpose.


text: Key components of our cybersecurity risk management strategy include: • We have a dedicated Information Security team principally responsible for implementing and managing our cybersecurity strategy and controls. • We use industry standard technologies and tools appropriate to our operations which are designed to prevent and detect unauthorized access to, or compromise of, our network, servers, endpoints and external applications, such as multi-factor authentication, malware protection, firewalls and monitoring controls. • We regularly train our personnel on cybersecurity awareness and conduct periodic additional awareness and training activities such as simulated phishing campaigns. • We have in place an Incident Response Plan that governs how we respond to and manage cybersecurity incidents. We conduct regular tabletop exercises to test our response to potential incidents. • We use third-party service providers where appropriate to design, implement and support aspects of our security processes as well as to monitor and test our safeguards.


text: Our cybersecurity risk management strategy forms part of our overall enterprise risk management program. We conduct regular risk assessments designed to identify cybersecurity threats and other risks to the company. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence, and any potential damage that could result from such risks. We also evaluate the sufficiency of our existing internal controls and monitor the effectiveness of such safeguards. In response, we adjust our processes and controls as necessary.


text: Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. For example, as part of our contract management process, we conduct IT security reviews, and require executive approval by the General Counsel, Chief Financial Officer and Executive Vice President of Global Operations in relation to products or services that could potentially expose our company to cybersecurity risks.


text: As of the end of fiscal year 2025, we have not identified any risks from known cybersecurity threats (including as a result of any prior cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. While our cybersecurity risk management strategy is intended to assess, identify and manage material risks from cybersecurity threats, it may not adequately do so in every instance, particularly given the evolving nature of the cybersecurity threat landscape. We expect that our policies and processes will continue to be subject to update as the risks from cybersecurity threats change. For more information about risks from cybersecurity threats, and whether they are reasonably likely to materially affect our business strategy, results of operations or financial conditions, please see the Risk factors discussion in Item 1A of this Form 10-K, including "Risks related to system security, cyber-attacks and data breaches".


text: Cybersecurity Governance The Board of Directors' overall risk oversight function includes receiving reports on the Company's cybersecurity risks and our risk management processes, and assessing whether our risk management strategies are reasonably designed to address such risks. The Board has delegated this oversight responsibility to our Audit Committee, which reports periodically to the Board as appropriate.


text: Our Executive Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Executive Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: SEKISUI HOUSE U.S., INC.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes to our processes to comply; b. Conduct periodic customer data handling and use requirement training for our employees;


text: c. Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: d. Conduct regular phishing email simulations for all employees; and e. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Vice President of IT of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of IT. Our Vice President of IT has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Vice President of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan.


text: Risk Management and Strategy Identifying, assessing and managing cybersecurity risks is an important component of White Mountains's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries/affiliates.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 38 for more information about these risks.


text: White Mountains's Board of Directors has assigned oversight of the Company's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.


text: White Mountains's Information Technology ("IT") Steering Committee, which includes its Chief Information Security Officer, Chief Technology Officer and various members of senior management, as well as the senior IT leadership at each of its consolidated subsidiaries/affiliates are responsible for assessing and managing White Mountains's cybersecurity risk. These individuals include IT and cybersecurity professionals with relevant education, including degrees and/or certifications, and prior work experience. These individuals also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Senior IT leadership at our consolidated subsidiaries/affiliates communicate information regarding cybersecurity risks to Company personnel through a variety of channels, including discussions between or among subsidiary/affiliate management and the Company, reports made to subsidiary/affiliate boards and direct updates to the Company's senior management and/or IT Steering Committee.


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 41 for more information about these risks.


text: The Company's Board of Directors has assigned oversight of White Mountains's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.


text: Cybersecurity threats pose a risk to the Company, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into internal systems or the systems of third-party vendors could adversely impact the Company's operations or damage its reputation. The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable and resilient technology infrastructure, fostering a culture of technology risk awareness and continuously improving its technology risk management practices. The Company's process for monitoring and mitigating cybersecurity risk is designed in conjunction with its overall Enterprise Risk Management Policy. The Company's Information Security Program follows ISO 27002, an international standard for information security controls, as well as references to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Federal Financial Institutions Examination Council Information Examination Handbook, and other regulatory guidance and industry standards.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Director of Enterprise Information Security is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks to the Information Security Officer, who works in tandem with the Chief Risk Officer and collectively report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The Director of Enterprise Information Security and the Information Security Officer have 30 and 22 years, respectively, of information security experience across a wide range of industries and both possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting them maintain education and certification requirements necessary to carry out their responsibilities.


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents addresses the prevention, detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees, such as of the ITRGC, and depending on incident severity, the Board or Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third Party Risk Management Program ("TPRM") is involved with onboarding and ongoing monitoring of these vendor relationships. TPRM documents the Company's view of applicable third party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.


text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: While the Company has seen attempts to gain access against its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2023. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Item 1A this Report.