text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes annual third-party audits to test its cybersecurity systems and incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's Chief Executive Officer and Chief Financial Officer are briefed on a quarterly basis on the results of these reviews.

companyName: Matson, Inc.

ticker: MATX

secItem: Item 1C


text: Training, education and awareness-building are mechanisms Matson uses to help embed a strong culture of cyber and information security within its workplace. The Company's long-term aim is to have a workforce with high-functioning knowledge of cybersecurity. In furtherance of this aim, the Company conducts training annually for employees that addresses cyber and information security, and holds additional training typically at least three times per year for specific topics such as data and email security. Furthermore, Matson requires enhanced training for employees with access to particularly sensitive information. The Company also has specific escalation processes and resources in place for employees to raise a concern should they notice anything suspicious.


text: The design of Matson's vessel and office information technology systems is informed in part by the following third-party frameworks or standards: NIST Cybersecurity Framework NIST 800-171 DFARS 252.204-7012


text: IMO MSC-FAL.1/Circ.3/Rev.2 BIMCO's Guidelines for Cyber Security Onboard Ships IAPH's Cybersecurity Guidelines for Ports and Port Facilities In addition, Matson participates in the following organizations in its effort to better understand best practices and advance its systems and policies over time:


text: National Security Administration ("NSA")'s Cybersecurity Collaboration Center U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership Federal Bureau of Investigation ("FBI") InfraGard U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center ("MTS-ISAC")


text: In the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "


text: Governance: Matson's Board of Directors has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board of Directors at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 17 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and Senior Director, Information Security, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and Senior Director provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board of Directors, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and Head of Internal Audit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our information systems.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: We utilize the United States National Institute of Standards and Technology, Cybersecurity Framework (NIST CSF) in considering the design and in assessing our processes. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.


text: Index to Financial Statements Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;


text: a cyber resilience team jointly responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk management process for service providers, suppliers, and vendors that aligns to our compliance requirements.


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers may be vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.


text: Cybersecurity Governance Our Board considers cybersecurity and other information technology risks as part of its risk management and compliance oversight function. The Board oversees management's implementation of our cybersecurity risk management processes and receives reports from management on our cybersecurity risks at least twice a year. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives briefings from management on our cyber risk management processes, and it receives presentations on cybersecurity topics from our Chief Technology Officer, Chief Information Security Officer and Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team has overall responsibility for assessing and managing material risks from cybersecurity threats, and for executing on our cybersecurity risk management processes. Our Chief Technology Officer, Chief Information Officer and Chief Information Security Officer, among others, have decades of combined experience in areas such as information technology, compliance, and cybersecurity program design and management. Additionally, certain leaders and personnel within the cybersecurity operations team hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager. Our management team works closely with our cybersecurity operations team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT, Operational Technology (OT), and products and services environments.


text: Risk Management and Strategy In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security leads the Company's cybersecurity efforts under the direct oversight of our Chief Technology Officer. Together, these individuals have over 50 years of experience involving information technology, including security, auditing, compliance, systems and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented trainings designed to provide best practices for protecting our network and systems, and also routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.


text: The Company has a crisis response team comprising senior members of various corporate functions to oversee the response to various crises including potential crises arising from cybersecurity incidents that may impact the Company and/or its vendor partners. This team conducts regular tabletop exercises to simulate responses to cybersecurity incidents. To the extent there is a cybersecurity incident impacting the Company and/or a vendor partner, the crisis response team's process would be to ensure that our Head of Information Security and Chief Technology Officer are informed immediately and that the potential impact of the incident and remedial measures arising from the incident are communicated to the executive officers of the Company.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the five core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond and recover.

companyName: RLI CORP

ticker: RLI


text: As of the date of this report, risks from cybersecurity threats or incidents have not materially affected, nor are they reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. However, in light of emerging and changing cybersecurity threats and vulnerabilities, the Company cannot guarantee that it will not be a victim of a cybersecurity attack in the future that could materially affect the Company. See Item 1A, Risk Factors for more information.


text: The RLI Corp. Board of Directors provides oversight for cybersecurity risks primarily through its audit committee. The Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO), along with the head of the Company's IT security department, present quarterly to the audit committee on cybersecurity risks and the Company's strategies and actions to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO/CISO and the Company's head of IT security on select cyber security topics, and "table top" simulations of a cybersecurity event.


text: Management oversight of cybersecurity risks is provided through the Company's risk committee, which is chaired by the chief executive officer and comprised of members of senior management. Among its responsibilities, the risk committee identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The risk committee meets quarterly and reviews the Company's current assessment of cybersecurity risks conducted by the Company's CIO/CISO and IT security department based on leading cybersecurity frameworks. The risk committee also periodically conducts a detailed review of cybersecurity risks.


text: The Company's IT security department, which operates under general oversight of the Company's CIO/CISO, is responsible for day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's CIO/CISO has 25 years of technology and technology leadership experience, including 13 years serving as a CISO in the insurance industry.


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; members of an Executive Cybersecurity Committee comprised of the chief executive officer and senior management; and the board of directors regarding the detection, assessment and response to a cybersecurity event.


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire to identify the cybersecurity controls and protections maintained by a third party.


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. Cybersecurity is incorporated into the Company's enterprise risk management ("ERM") program that is reviewed by the Board of Directors ("the Board"). Our Audit Committee has authority to oversee cybersecurity matters as part of its review of ERM. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: As part of our program management activities, we actively engage internal and prominent external experts, as well as industry participants, as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. The Company has adopted a cybersecurity incident response plan (the "Incident Response Plan") which defines our approach for prompt detection, analysis and determination of materiality, prioritization and mitigation of cybersecurity incidents. The Incident Response Plan also includes criteria for escalation to cross-functional committees, including executive management, and notification to our Board, as appropriate. Management also periodically performs tabletop exercises to simulate actual cyber threats to strengthen our policies, standards and related governance processes in response to cyber events. In addition, our internal audit function performs periodic audits or other evaluations to assess our cybersecurity program and compliance with policies and procedures.


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"). Our CISO has formal education in information technology and extensive cybersecurity program management experience with over three decades of diverse experience in the chemicals and manufacturing industries and maintains various information security certifications. Our CISO is accountable for the enterprise-wide cybersecurity strategy for both information technology (IT) and operations technology (OT), including significant third-party risks. The cybersecurity team, led by our CISO, is responsible for policies, standards, architecture, tools, training and processes to keep Trinseo secure. Our CISO provides regular updates to our cross-functional committees on program objectives, effectiveness, emerging trends, and performance metrics.


text: The Board has ultimate oversight of cybersecurity risk and our CISO provides periodic reports and updates concerning our cybersecurity program to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Cybersecurity reports to the Board generally occur at least annually, with updates as deemed necessary by our CISO, senior management, or as required by our Incident Response Plan. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information network and data security, assessments of the information security program, and the emerging threat landscape.


text: Trinseo faces risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, financial condition, cash flows or reputation. Trinseo has experienced, and will continue to experience, cyber incidents in the normal course of our business. Trinseo has not experienced any material cybersecurity incidents or incurred material expenses related to cybersecurity incidents. As of the date of this report, we are not aware of any material risks from cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, financial condition or reputation. See Item 1A Risk Factors for a discussion of cybersecurity risks.


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the audit committee of our board of directors (the "Audit Committee"). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our risk management team, which includes members of senior management, including our Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and General Counsel, as well as external consultants, works closely with our information technology department ("IT Department") to continuously evaluate and address cybersecurity risks relevant to our business and operations. In addition, we have set company-wide policies and procedures that directly or indirectly relate to cybersecurity matters, such as policies related to encryption standards, antivirus protection, access removal, multifactor authentication, confidential information or use of the internet, social media, email and wireless devices. These policies go through an annual internal management review and approval process.


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Audit Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to our board of directors on a quarterly basis.


text: Our IT Department management team meets monthly to assess and review cybersecurity status, which includes dashboard reviews, operational risks and company compliance. Annually, our internal audit group and third-party consultants meet with our IT Department to perform risk assessment walkthrough meetings, discuss potential enhancements, materiality of risks and alignment with the Center for Internet Security Critical Security Controls framework. In addition, we engage third-party consultants to perform annual red team exercises and external penetration tests.


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party manager applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: In assessing cybersecurity threats, our IT Department has established controls and procedures for responding to cybersecurity incidents, including a process to evaluate the significance of a cybersecurity incident. Members of senior management, including our General Counsel and CFO, are tasked with performing a materiality assessment in the event of a cybersecurity incident, which includes the consideration of relevant quantitative and qualitative factors, as well as SEC guidance. Based on the results of this evaluation, further escalation of the cybersecurity event may occur, which may include our CEO, our board of directors and/or law enforcement. In addition, members of senior management will determine, based on the assessment described above, whether the cybersecurity incident requires disclosure with the SEC.


text: We or our third-party manager currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Due to our structure as a REIT, the cybersecurity program, processes and strategy described in this section are limited to the corporate systems, information and service providers belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Our program is informed by the International Standards Organization ("ISO") 27000, ISO 270001, and National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27000, ISO 27001 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program are integrated into our overall enterprise risk management program, and share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: cybersecurity awareness training of our employees and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cybersecurity Governance Our board of directors (the "board") considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the "committee") oversight of cybersecurity and other information technology risks. The committee oversees management's implementation of our cybersecurity risk management program.


text: The committee reports to the board regarding its activities, including those related to cybersecurity. The board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management as part of the board's continuing education on topics that impact public companies.


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information technology team has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We use some of the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The team possesses various industry certifications and continuously refreshes their skills through relevant training.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We operate in an increasingly interconnected digital landscape and we recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. In the normal course of business, we may collect and store certain sensitive information, including proprietary and confidential business information, intellectual property, sensitive third-party information, employee information and personal information. We rely on information systems for the management of this information in addition to our management of business processes including inventory, payment of obligations, collection of cash, human capital management, financial tools and other processes and procedures. Our ability to manage our business effectively depends on the reliability and capacity of these systems. We seek to address these risks by safeguarding assets, data, and operations through the cybersecurity risk management processes described below: Risk Assessment:

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Regular assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities. These assessments include penetration testing, vulnerability scanning, and red teaming exercises conducted by third-party service providers, which help us to evaluate the likelihood and potential impact of cybersecurity incidents. Feedback from these assessments is incorporated into our systems and procedures through upgrades intended to further improve our security posture.


text: A monitoring and detection system has been implemented to help identify cybersecurity incidents. The IT Security Department is tasked with monitoring certain network activities, logs, and system behavior, leveraging threat detection technologies. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to follow industry best practices and aligns with legal and regulatory requirements. This plan is designed to provide for immediate action to contain the incident, mitigate the impact, and restore normal operations efficiently.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees receive training on recognizing and reporting potential cybersecurity threats, best practices for data protection, and adhering to cybersecurity policies and procedures. Additionally, periodic simulated phishing exercises are conducted to enhance employee readiness in identifying and mitigating phishing attacks.


text: Access control policies have been implemented to limit unauthorized access to sensitive information and we seek to maintain and monitor critical systems. Multi-factor authentication is used for remote access, use of privileged accounts and access to critical systems.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.


text: The above cybersecurity risk management processes are integrated into the Partnership's overall risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered as an important component of our enterprise-wide risk management approach. We have assembled a Cybersecurity Steering Committee comprised of IT management, cybersecurity specialists, and representatives of business management, including the CTO and internal legal counsel. The Cybersecurity Steering Committee reviews information security policies and cybersecurity risks in conjunction with other operational, financial, and strategic risks to ensure alignment with our business objectives. The Cybersecurity Steering Committee convenes regularly to review and monitor the Partnership's programs for the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Cybersecurity Steering Committee receives reports on security incidents, threat intelligence, and vulnerability assessments from our IT Security Department.


text: The Cybersecurity Steering Committee regularly reports to the CFO through the CTO and reports annually on cybersecurity to the Audit Committee during a scheduled meeting. These reports include, as appropriate, updates on the current cybersecurity landscape, incident trends, and any significant developments that may impact the Partnership's security posture.


text: To enhance the effectiveness of our cybersecurity program, we periodically engage external assessors, consultants, and auditors. These third-party service providers conduct independent evaluations of our cybersecurity measures, helping to identify areas for improvement and adherence to industry standards and best practices.


text: Our IT Security Department recognizes that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process designed to assess and oversee the cybersecurity practices of our vendors. Before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.


text: Impact of Risks from Cybersecurity Threats During 2023 and through the date of this Annual Report on Form 10-K, though the Partnership and our service providers may have experienced cybersecurity incidents, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Partnership, including our business strategy, result of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our IT Security Department aims to monitor and assess these risks to maintain the security and continuity of our operations. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. Please see "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Board of Directors oversees risks from cybersecurity threats. Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, the Audit Committee and the Board of Directors hold discussions with management, including the CTO on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures annually and as needed during both scheduled and special meetings. If new material cybersecurity risks arise, the Board of Directors and the Audit Committee are informed through regular discussions between the CFO and both the Chairman of the Board and the Audit Committee Chair. These discussions are then brought to the attention of the Board of Directors and Audit Committee at the next meeting.


text: Management's Role and Expertise The CTO and the Cybersecurity Steering Committee are responsible for overseeing and executing our cybersecurity strategy, including the assessment and management of cybersecurity risks. The CTO reports directly to the CFO and maintains communication with the Audit Committee, the Board of Directors and the Cybersecurity Steering Committee with respect to information security and cybersecurity matters.


text: The CTO holds a Master of Business Administration from the University of Kentucky/University of Louisville's joint executive program and has an extensive background in information security, risk management, and incident response with over twenty years of varying information technology roles with increasing responsibility at both private and public companies. The CTO is supported by a dedicated team of cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Risk Management and Strategy We prioritize the management of cybersecurity risk and the protection of information across the Company by embedding data protection and cybersecurity risk management in our operations. The Company follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and other industry standards and applicable laws and regulations to assess and manage cybersecurity risks within our services, infrastructure, and corporate resources. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes through a layered governance structure.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: The Company maintains an enterprise-wide risk management ("ERM") process to identify, assess and monitor risks that are or may become material to our business. Our ERM process includes participation by senior management, other leaders, and employees across the business in surveys and discussions about the risk environment with certain members of senior management and management level leaders meeting quarterly to discuss the Company's top risks as identified through our ERM process.


text: Our cybersecurity policies and controls encompass incident response procedures, information security, and IT vendor risk management. We monitor the cybersecurity laws, regulations, and guidance applicable to us in the maintenance of these policies and procedures, including, but not limited to, regulations issued by the U.S. Department of Homeland Security, as further described in Item 1 (Business) of this Annual Report on Form 10-K, as well as proposed laws, regulations, guidance, and emerging risks.


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by AI, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2023. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 37 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for four years and previously served as our Director of Infrastructure Management for 12 years. Our CTO reports to the Company's Chief Innovation Officer and President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 32 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.


text: We also have management-level committees who support our processes to assess and manage cybersecurity risk and related incidents as follows:


text: The Information Security Executive Sponsors Committee (the "Executive Sponsors Committee"), chaired by our Director of Information Security, includes IT, legal, compliance and other business leads. The Executive Sponsors Committee provides a forum for these cross-functional members of management to consider existing and emerging cybersecurity risks; review cybersecurity regulations; determine cybersecurity project prioritization; approve, review, and update policies and standards, as appropriate; and promote cross-functional collaboration to manage cybersecurity risks across the enterprise to support the Company's goals and address cybersecurity risks.


text: The Risk Management Committee, comprised of senior IT, operations, risk, legal, and compliance leaders across business segments, monitors enterprise risk management for the Company, including all subsidiaries. Among other processes, this committee reviews the Company's programs and processes related to information security, third-party risks, vendor management, business disruption, business continuity, and disaster recovery, identifying gaps in the current risk management processes and considering potential risks due to changes in laws or the regulatory environment.


text: The Cybersecurity Incident Response Team, which includes representatives from our information security and technical services departments, in addition to company management and executives across the Company, is activated when a suspected incident is reported or discovered and is responsible for dissemination of information and coordination of personnel efforts required to successfully respond to an incident.


text: The Cybersecurity Incident Reporting Committee was formed to assess the materiality of cybersecurity incidents from a Securities and Exchange Commission reporting standpoint. In the event this committee determines a cybersecurity incident is material, committee members, as delegated, will notify the Audit Committee. The CTO provides a quarterly cybersecurity risk update and presents an annual cybersecurity review to our Board of Directors.


text: We also conduct mandatory company-wide security awareness training and periodic phishing tests and generally seek to promote awareness of cybersecurity risks through regular communication and education of our employees.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks such as the National Institute of Standards and Technology ("NIST") and other similar industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NETLIST INC

ticker: NLST


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;


text: conduct regular cybersecurity awareness training for all employees; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Difficulties with our global information technology systems, including any unauthorized access or cyber-attacks, could harm our business" which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Financial Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Senior Director of IT and Security. Such individuals have over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Axcelis implements an enterprise risk management ("ERM") process in which management annually identifies and reviews the principal risks to which the Company's business is subject, rating each risk in terms of likelihood of occurrence and severity of impact. Risks that have either a high likelihood or a high potential impact on our business are assessed quarterly with respect to the trend (an increasing or decreasing risk) and whether additional mitigation actions are needed. These quarterly risk assessments are shared with our Board of Directors, with the Audit Committee reviewing any changes in risk identification or ranking on an annual basis.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Cybersecurity risks are integrated into our overall ERM, and our Chief Information Officer assesses the trends and need for additional mitigations on a quarterly basis. Our main concerns are (i) the unauthorized exfiltration of personal information pertaining to Axcelis employees, (ii) the unauthorized exfiltration of confidential business or technical information, and (iii) an inability to use our business systems for a period of time following a cybersecurity event.


text: Management has adopted a Cybersecurity Incident Response plan which lays out the roles of IT personnel, senior leadership, and legal resources in responding to a cybersecurity incident. This plan is shared with our Board of Directors and reviewed annually. These risks could materially impact the business of the Company. To date, the Company has not experienced a material cybersecurity incident.


text: To implement risk management and protective strategies, management implements a "Layered Security Strategy" that aligns with National Institute of Standards and Technology Cybersecurity Framework. We consider the various factors that can play a role in the occurrence of a cybersecurity incident, such as: Unauthorized system access User errors Undetected system vulnerabilities Mobile device risks Vulnerabilities in software applications and specific hardware Third party cybersecurity risks Insider threats


text: Management has implemented specific mitigation strategies for each of these factors, such as (i) user training to avoid fraud and other scams, (ii) utilizing multi-factor authentication processes for system access, (iii) engaging in vulnerability scanning applications, (iv) upgrading software and hardware to those with the greatest security protections, and (v) ensuring third parties to whom sensitive information is provided have appropriate security. Management has also developed a vendor assessment form to evaluate potential "Software as a Service" providers, which is incorporated in the Company's RFP processes. The Company routinely obtains and reviews SOC 2 reports from third parties who have access to the Company's information, some of which are part of management's internal controls over financial reporting. The Company accesses cybersecurity consultants and legal counsel to assist in the identification of vulnerabilities and advise on appropriate mitigation and preparedness actions.


text: Overall, we devote significant resources to network security, data encryption, employee training and other measures to protect our systems and data from unauthorized access or misuse. The Audit Committee and full Board of Directors receive quarterly reports on cybersecurity risks and annual reports on management initiatives to promote cybersecurity.


text: Risk Management and Strategy We recognize the importance of maintaining the security of our information systems and assets, and have several cybersecurity processes and controls designed to identify, assess and manage the risks associated with cybersecurity threats and cybersecurity incidents.

companyName: GLAUKOS Corp

ticker: GKOS


text: Risk Management Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to this risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. Both the Audit Committee and the full Board regularly receive reports from such outside experts in response to emerging or higher risk areas.


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Information Technology (IT) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If impact is present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake the activities listed below: closely monitor emerging data protection laws and implement responsive changes to our processes; conduct annual cybersecurity training for all employees and contractors who use our systems; conduct regular email phishing testing exercises for all employees to enhance awareness and responsiveness to such possible threats;


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential;


text: schedule tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes, technologies and incident response plan; and carry cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident.


text: Engagement of Third Parties As part of the above processes, we regularly engage with assessors, consultants, and other third-parties to review our cybersecurity program. These reviews are intended to evaluate the effectiveness and robustness of the security measures implemented in our networks and information systems, identifying potential vulnerabilities, performance improvements, and recommended improvement strategies. These security assessments may focus on key areas such as user access controls, data encryption processes, auditing and monitoring of database activities, system and server configuration and update procedures.


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems.


text: We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Material Impact of Cybersecurity Threats or Incidents We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Risks Related to our Business, " included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.


text: We are not aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Technology of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the company's plans to mitigate those risks, and discusses such matters with our head of IT and other members of senior management. Potentially material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our IT department. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Risk Management and Strategy As a financial institution in today's digital landscape, we understand that cybersecurity and data protection are of paramount importance to our business, our customers, and our reputation. With the proliferation of online banking and the digitalization of financial services, we recognize that our policies and procedures for safeguarding sensitive customer data must be as sophisticated as the cyber threats we are defending against. Accordingly, cybersecurity is a high-priority component of our overall risk-management system and risk-control infrastructure. We have implemented robust, multi-layer security procedures and defense strategies that aim to proactively mitigate cyber risks, enable our early detection and prevention of security incidents, minimize our vulnerability to attacks, and protect us from both internal and external cybersecurity threats.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Commensurate with the risks we face and the sensitivity of the data and systems we are protecting, our Information Systems Security Program (ISSP) includes layers of administrative and technical safeguards designed to protect the confidentiality and integrity of sensitive information belonging to us and our employees, partners, and customers, to guard against the unauthorized access, alteration, disclosure, or destruction of that information, and to defend that information from potential, known, emerging, and evolving security risks. We have established multiple control points within our security infrastructure to reduce the risks associated with embedded technologies that could fail or be manipulated by nefarious actors, to prevent the intentional and unintentional infiltration of cybersecurity threats, and to maximize their separation from our sensitive information systems and assets. In developing our ISSP, our policies, standards, and procedures were heavily informed by and incorporated provisions from various sources of statutory and regulatory guidance as well as numerous leading industry frameworks, including the NIST Cybersecurity Framework, various NIST special publications, the Fair Information Practice Principles established by the Federal Privacy Council, the Privacy Management Framework developed by the American Institute of Certified Public Accountants, and the Center for Internet Security's Critical Security Controls.


text: Enterprise Information Systems Security Policy, which, among other objectives, prescribes a comprehensive framework for creating a practice-based Information Security Management System; protecting the confidentiality, integrity, and availability of our data and systems; providing for the development, review, maintenance, and ability to ensure the effectiveness of minimum security controls required to protect our data and systems; and recognizing the highly-networked nature of the current computing environment to provide effective company-wide management and oversight of related cybersecurity risks;


text: Corporate Account Takeover Policy, which serves to mitigate the risks of corporate account takeover crimes and to document our compliance with the Texas Department of Banking's Supervisory Memorandum 1029 on "Risk Management of Account Takeovers," dated September 30, 2019, and the FFIEC's guidance on "Authentication and Access to Financial Institution Services and Systems," dated August 11, 2021;


text: Vendor Management Policy, which provides a risk-based process for identifying, measuring, monitoring, and managing third-party relationships with new and existing vendors by requiring an assessment, categorization, and ranking of the risks associated with each third-party vendor and implements a third-party risk-management process that focuses on risk assessment, due diligence in selecting third-party vendors, contract structuring and review, and ongoing oversight of the operational and financial performance of the third-party vendor's products and services;


text: Service Center Physical Security for Data and Computing Equipment Policy, which provides directives for implementing appropriate physical security controls to protect the hardware, infrastructure, and systems that store and transmit our sensitive information and data from damage, unauthorized access, and loss of availability; to monitor, analyze, and properly disclose security alerts and information; and to administer other administrative and technical operational security procedures; and Security Incident Response Policy, which establishes the steps necessary to ensure a timely and adequate response to security incidents impacting our security systems or infrastructure.


text: Some of the steps we have taken and processes we have implemented to assess, identify, and manage material risks from cybersecurity threats include the following:


text: Forming an IT Cybersecurity Committee (ITCC), which consists primarily of members of our management team and IT department, to develop and oversee our cybersecurity policies and infrastructure and establishing a multi-tiered reporting and governance system pursuant to which our ITCC reports to our Service Center Board, which reports to our Risk Committee, which reports to our Board;


text: Implementing heightened safety measures, physical-security controls, and controlled-access requirements to protect the Service Center that houses the hardware and infrastructure used to store and transmit sensitive and confidential bank, customer, and employee information in accordance with the FFIEC IT Examination Handbook on Information Security and designating a specialized Service Center Board within the Service Center Department to oversee the protection of the Service Center's physical integrity;


text: Maintaining a clearly defined ISSP, which prescribes measures to establish and enforce our security program, addresses each component of our information security (IS) position, and advances our objectives of protecting and managing risks to our data and security systems by establishing policies, standards, controls, procedures, and guidelines that address topics such as security and privacy governance, statutory, regulatory, and contractual compliance, business and disaster recovery, change management, identification and authentication processes, expectations for continuous monitoring, asset management, third-party provider management, endpoint security, and incident responses, among others;


text: Conducting an annual self-assessment using the Cyber Risk Institute (based on the NIST Cybersecurity Framework) to review our cyber risk-management strategy and framework, assess the effectiveness and legal and regulatory compliance of our organizational cybersecurity policy, and evaluate our policies and procedures for identifying risks, protecting information, detecting security threats, responding to cyber incidents, executing recovery plans, and managing levels of external dependence and resiliency;


text: Conducting regular cybersecurity training for our employees regarding security awareness, the proper use and handling of sensitive information, and the protocols in place to identify, assess, and manage any cybersecurity threats and periodically testing employees' cybersecurity knowledge, policy compliance, and response rates by engaging with third-party providers to conduct internal social engineering campaigns;


text: Engaging in security-incident preparedness simulations and completing disaster recovery and resilience tests designed to test and strengthen any vulnerabilities in our cybersecurity infrastructure;


text: Employing robust encryption and anonymization technologies and other cybersecurity monitoring and auditing systems to fortify our cybersecurity framework, including through our Online Banking Enhanced Security Program, which requires the authorized users on a customer's account to be validated and employs multi-factor authentication (MFA), which requires each of our retail and commercial customers to authenticate their identities by entering a secure access code that our MFA system automatically generates and sends to the customer each time there is an attempted login to the customer's online banking account;


text: Implementing MFA protections for our treasury customers by prohibiting their initiation of ACH transactions or wire transfers until they authenticate their identities using a security token that is generated and sent by our online-banking MFA system; Monitoring electronic mail and other network intrusion attempts with various tools to identify and stop intrusion and malware threats;


text: Scanning and assessing vulnerabilities arising from software and hardware on our network infrastructure, ATMs, software applications, computers, copiers and other electronic assets to ensure that vulnerabilities are identified and resolved timely;


text: Establishing a risk-appetite profile, which we review at least annually to regularly assess our cybersecurity infrastructure and software systems in a manner that ensures we capture their current state and identify emerging risks that would require changes in our cyber environment;


text: Leveraging internal and external auditors as well as security consultants to review the procedures, systems, and controls that comprise our ISSP to evaluate their design and operational effectiveness and to address any operational deficiencies or security weaknesses; and Maintaining an Incident Response Plan that establishes our procedures and standards for responding to actual or potential cybersecurity threats or incidents, which we review at least annually.


text: Furthermore, our IT security infrastructure and cybersecurity policies are designed to monitor and manage security risks associated with any third-party service providers, suppliers, software and hardware vendors, contractors, and consultants we collaborate with (hereinafter, collectively, Vendors) who might store, process, collect, share, create, transmit, destroy, or access any of our sensitive data. Our Vendor Management Policy establishes clearly defined requirements of engagements with Vendors and requires them to uphold similar security standards to those we internally require. Depending on their risk level, we may subject certain Vendors to heightened security requirements, such as enhanced risk assessments, ongoing monitoring, or additional contractual controls to restrict their levels of information access.


text: IT Cybersecurity Committee. As part of our cybersecurity governance framework and for purposes of establishing and maintaining our ISSP, we have established an IT Cybersecurity Committee (ITCC), which consists predominantly of members of our management team and IT department. The ITCC is subject to oversight by the Service Center Board, the Risk Committee, and the Board. The Risk Committee of the Board works directly with the ITCC to develop and implement our policies and procedures concerning cybersecurity and data protection. As stated in the Risk Committee Charter, our Risk Committee reviews management reports on the adequacy of our data-governance activities and IT security program; evaluates risks related to customer information, significant outsourcing with third parties or Vendors, and operational outsourcing arrangements; reviews, evaluates, and updates our data-governance framework, processes, and systems for identifying, assessing, and managing data risks that impact critical business operations; and reviews and evaluates our overall risk-management framework.


text: The ITCC meets at least quarterly to discuss its oversight of our cybersecurity policies and procedures, risk-management practices and controls, and efforts to mitigate and prevent cybersecurity risks. The ITCC may meet more frequently if required by our Incident Response Plan to facilitate timely response, monitoring, risk-management, and recovery efforts. The ITCC is also charged with periodically reporting to management, the Board, and the Risk Committee, the status and results of our compliance with our security program, results of security assessments, and effectiveness of remediation activities.


text: Other Committees. In addition to the ITCC and Risk Committees, we have established a Technology Committee, a Senior Management Committee, and a Business Continuity and Disaster Recovery (BC/DR) Committee. Each oversees aspects of our ISSP and coordinates with the ITCC to implement various cybersecurity procedures.


text: Chief Information Security Officer. In addition to establishing the ITCC and other committees, we designated a Chief Information Security Officer (CISO) to oversee all aspects of our IS policies, procedures, and controls. Our CISO reports to our Senior Management Committee, the ITCC, the Risk Committee, and the Chairman of the Board. At least annually, the CISO presents all of our IS policies to the Board. The CISO is also tasked with maintaining an effective Security Awareness Program and providing training to our management, Board, and employees on an annual basis. Additionally, the CISO meets with our Audit Committee on a quarterly basis to inform them of material cybersecurity-related regulatory updates and with our full Board on a monthly basis to discuss and provide pertinent regulatory information.


text: Procedures Governing our Cybersecurity Incident Responses. Our multi-layered, cross-functional approach to cybersecurity governance provides adequate checks and balances on the implementation of our cybersecurity protocols, enables us to effectively monitor both internal and external cyber risks, and allows for the swift escalation of any potential cybersecurity incidents to the appropriate levels of management so that assessments concerning materiality, potential disclosure, and possible responsive actions can be timely made. Our approach to cybersecurity governance is modeled in the Incident Response Team (IRT) that we have established to timely address cybersecurity incidents and minimize any disruptions to our business operations and customer activities caused by cyber threats or attacks. Designated IRT personnel are available 24 hours per day, seven days per week to respond to potential incidents. Having an integrated team for incident response facilitates information sharing, which allows organizational personnel, including developers, implementers, and operators, to leverage the team knowledge of the threat in order to implement defensive measures that will deter intrusions more effectively. In the event of a potential cybersecurity incident, our IRT is responsible for implementing our Security Incident Response Policy, in accordance with which the following steps occur:


text: After becoming aware of a potential cybersecurity incident, our IT Service Desk reports the incident and any pertinent information to our CISO. Our IT Service Desk is the central point of contact for reporting computer incidents or intrusions.


text: The CISO then conducts a preliminary analysis of the incident and determines whether activating the full IRT is warranted. Types of incidents that would generally require the activation of our IRT include but are not limited to a breach of personal information, a denial-of-service (DoS) or distributed DoS attack, excessive port scans, a firewall breach, or a virus or malware outbreak.


text: If the type of incident or the threat created by the incident necessitates a full-scale response by the IRT, the CISO notifies a team of network and security engineers, security analysts, and Windows / Unix / Linux systems administrators (collectively, the IT Security and Engineering Teams).


text: At the CISO's direction, the IT Security and Engineering Teams gather intel regarding the incident and take pre-planned steps to mitigate harm, address system weaknesses, and block ongoing threats. For example, our network engineers analyze network traffic for external attacks, search for signs of a firewall breach, and take action to block a suspected intruder's network traffic; our security analysts and engineers look for indications of an attack or suspicious activity by monitoring and reviewing the network activity of our business applications and the audit logs of our mission-critical servers; and our systems administrators examine system logs of our critical systems for any abnormal activity, confirm our mission-critical computers are up to date on all service packs and patches, and ensure backups have been created for our critical systems. The CISO reports the incident to our executive management team, Service Center Board, and ITCC.


text: Our CISO, executive management team, Service Center Board, and ITCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.


text: Procedures Governing our Third-Party Vendor Relationships. Similar to our governance approach with respect to responding to cybersecurity incidents, we have implemented a layered, collaborative governance system to manage our third-party Vendor relationships and to implement our Vendor Management Policy. Prior to working with any Vendor, we conduct a comprehensive security screening to evaluate the Vendor's security protocols and identify any potential vulnerabilities that could compromise our sensitive data. At least annually, we also perform a security assessment of the Vendor to identify any change in the Vendor's security posture that may negatively impact the security of our information systems. Our CISO or other designated IS personnel oversees and makes a final recommendation regarding the Vendor security assessments, determines the necessity of Vendor site visits, and coordinates and provides a final report on any site visit that occurs. Our Vendor relationships are monitored by our Vendor Management Department, the day-to-day operations of which are led by our Vendor Manager. In coordination with the applicable Business Unit Manager, the Vendor Manager categorizes and ranks the risks presented by our Vendors, performs Vendor due diligence, and provides periodic reports to our Board and Risk Committee concerning Vendor risk management. Before entering into any Vendor contract, the Business Unit Manager that will be contracting for the Vendor's service or product must perform a thorough risk evaluation. In addition to working alongside the Vendor Manager to categorize and rank Vendor risks, the Business Unit Manager participates in contract review and negotiations, establishes performance-monitoring controls, and completes Vendor reviews. The CISO or other designated IS personnel may participate with the Business Unit Manager in contract negotiations as needed.


text: Procedures Governing our Corporate Account Takeover Responses. Like our approaches to responding to cybersecurity incidents and managing our Vendor relationships, our strategy for managing corporate account takeover (CATO) threats integrates organizational operations at multiple governance levels involving our Board, executive management team, members of our Senior Management of Electronic Banking Services (EBS Management Team), an Electronic Banking Services Manager (EBS Manager), and our CISO. Our Board reviews our CATO Policy for compliance with the Texas Department of Banking standards for the risk management of CATOs and charges our EBS Management Team with the responsibility of determining necessary courses of action to ensure adherence to applicable guidance and regulations. Our EBS Management Team also ensures that our CATO Policy is understood and complied with across all of our operational divisions. Some of the responsibilities of our EBS Manager include developing, implementing, and maintaining policies and procedures to comply with our CATO Policy, coordinating the performance of period risk assessments of IBC Link, our online banking product, establishing trainings for IBC Link customers regarding security controls that mitigate CATO risks, reporting CATO incidents to executive management, and coordinating with our management team and IBC Link customers if an actual or threatened CATO attack is identified. Our CISO is responsible for ensuring appropriate security controls are implemented to prevent, detect, and respond to CATOs, establishing incident-response procedures to be employed if a CATO threat is in progress, and timely notifying our primary federal regulator of any CATO incidents that are required to be disclosed to comply with applicable laws, regulations, and CATO Policy procedures.


text: Notwithstanding the robust nature of our defensive measures and security processes and the multi-layered governance system that we have established to mitigate, monitor, analyze, and respond to incidents, cybersecurity threats are increasingly difficult to detect, and the risk of a data breach or cyber-attack is pervasive and severe. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks, stay apprised of changes in the cyber environment, and invest in strengthening our cybersecurity infrastructure. For additional information on our risks related to cybersecurity, please see "Risk Factors—Risks Related to Our Business— Our information systems may experience an interruption or breach in security."


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational, and financial risk areas.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our cybersecurity operations center and third party service providers responsible for monitoring and measuring threats, and (4) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; regular testing of our critical systems to identify and address potential vulnerabilities; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third party risk management process for certain service providers, suppliers, and vendors.


text: We regularly experience cyberattacks and other incidents, and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.


text: The Committee receives briefings from our Chief Information Security Officer ("CISO") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Company's information security team, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer, Chief Operating Officer, and Chief Accounting Officer are responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from the CISO and Chief Information Officer. The CISO together with the Chief Information Officer regularly report on the status of projects to strengthen the security of our information technology systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.


text: Our CISO has 25 years of experience in industries including government, retail, and manufacturing, and industry certifications including CISSP and GIAC. Our CISO also has experience in forensic investigations, strategic risk management, and security program development. The information security team has an average of 15 years of prior work experience in roles including incident response, forensics, vulnerability management network security administration, fraud prevention, and other governance, risk, and compliance areas. The team maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI along with industry certifications commensurate with their roles.