text: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices Detect anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program Respond to incidents regardless of source or causality Recover through planning, improvements and communications (external and internal)


text: Conduct after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.

companyName: VanEck Bitcoin ETF

ticker: HODL

secItem: Item 1C


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees.


text: Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response. In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.


text: Risk Management, Strategy and Governance The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the ETH Custodian and Additional ETH Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices. The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.

companyName: VanEck Ethereum ETF

ticker: ETHV


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption.


text: Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.


text: As of January 31, 2025, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. With oversight from our Board, the Audit Committee and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: KFORCE INC

ticker: KFRC


text: Management Oversight Our Chief Information Security Officer ("CISO") leads our Information Security and Data Privacy Council, which meets quarterly, or more frequently if necessary, to assess, identify and manage cybersecurity threats, support advocacy programs and advise our Chief Information Officer ("CIO") and CISO on solutions. The council is made up of key members of senior management across the Firm, including enterprise security, human resources, legal, internal audit, finance, procurement, communications and field management.


text: Our Enterprise Security team monitors and manages system infrastructure to protect the Firm against threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a defense in depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around the clock security operation center responds as appropriate to risks identified, and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the Enterprise Security team are communicated to the CISO and Information Security and Data Privacy Council.


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have extensive information technology and program management experience, and have served many years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if it is considered immaterial to us. Annually, the Board and management participate in a comprehensive strategy discussion on cybersecurity.


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee. As a result of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.


text: Management also provides the Audit Committee with an annual overview of Kforce's various lines of insurance that we maintain, including our cybersecurity insurance policy. The Audit Committee provides the Board with quarterly reports on the Firm's risks and ERM program findings, including cybersecurity risk and data privacy practices.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risk Factors Risks Related to Cybersecurity and Technology – Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations." in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.


text: Third-Party Vendor Management Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to Kforce as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.


text: Risk Management and Strategy Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats including: operational disruptions; violation of data privacy laws and regulations; breach of confidentiality; and financial and reputational harm.


text: With oversight from our Board, the Audit Committee, a special working group comprised of two of our Board members, and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access, including annual employee training. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").


text: Our enterprise security team monitors and manages system infrastructure to protect the Firm against cyber threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a comprehensive defense-in-depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around-the-clock security operation center responds as appropriate to risks identified and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the enterprise security team are communicated to the CISO, Information Security and Data Privacy Council and other senior leaders as appropriate.


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have over 35 and 25 years, respectively, of experience in information security and program management, and have both served over 10 years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market (and for Kforce, if any) and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests and other tests and assessments.


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate business impact (even if the incidents do not rise to the level of being material). Annually, the Board and management participate in a strategy discussion on cybersecurity.


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee.


text: As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, to our knowledge, we have not experienced a material breach to date. While all organizations are inherently at risk of cybersecurity threats, we do not believe that cybersecurity threats have affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we routinely face risks of cybersecurity incidents, wholly or partially beyond our control, and there can be no assurance that the security efforts and measures of the Firm and third-party providers will prevent incidents that could adversely affect the Firm's business. Refer to "Risk Factors Risks Related to Cybersecurity and Technology" in Item 1A. Risk Factors of this report for a discussion of risks from cybersecurity threats that could have a material adverse effect on our business, financial condition and results of operations.


text: Risk Management and Strategy We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems. The Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any such incidents that have occurred that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, acts of vandalism or terror, computer viruses, misplaced or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or processes of third-parties that have been entrusted with our information expose us to a risk of loss or misuse of this information, litigation and potential liability, which could have a material adverse effect on our business, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity attacks, network disruptions and breaches of data security, which could compromise our information and expose us to liability."


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.


text: Our Vice President, Information Technology leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.


text: Risk Management and Strategy We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that are designed to target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems and the Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis, we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity incidents, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, cybersecurity incidents, acts of vandalism or terror, misplaced, corrupted, altered or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or, processes of third-parties that have been entrusted with our information, could have a material adverse effect on our business strategy, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity incidents, network disruptions and breaches of data security, which could compromise our information and expose us to liability."


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats, as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.


text: Our Vice President, Information Technology is responsible for managing and assessing material risks from cybersecurity threats and leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.


text: In the past two years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: The Management Company's third-party advisor has performed cybersecurity risk assessments of its information technology security processes and implemented technologies to lessen risk. Using third party services, the Management Company monitors, scans, assesses, audits, and remediates identified vulnerabilities across its networks, as appropriate. Furthermore, recognizing that the Management Company's employees are an essential line of defense in cybersecurity, it requires employees to participate in training and testing programs through which it provides education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. The Management Company's policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: The Management Company's cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of its ongoing cybersecurity vulnerability management, and it endeavors to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to its networks and applications, along with detection of potential unusual activity within its networks or applications. Any potential cybersecurity incident is immediately reported to the President and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Entity's cyber risk management program, typically on an annual basis.


text: There have been no cybersecurity incidents which have materially affected the Management Company to date, including its business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect the Management Company, including its execution of business strategy, reputation, results of operations and/or financial condition.


text: In the past three years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.


text: We rely heavily on information systems to meet the operational and financial needs of our business. Therefore, we seek to continuously improve our approach to cybersecurity with the goal of ensuring the confidentiality, integrity and availability of our information resources and to reduce the risk of information loss by accidental or intentional modification, disclosure or destruction. We believe we devote appropriate resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Audit and Risk Committee on a quarterly basis. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. We regularly assess the cybersecurity landscape to holistically evaluate the threat of cybersecurity risks and seek to mitigate such risks through a layered cybersecurity strategy based on identification, protection, detection and recovery. Our Enterprise Cybersecurity Policy includes guidance related to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. This policy is reviewed for updates annually and approved by appropriate members of management. All coworkers are required to acknowledge review of the policy and complete cybersecurity and privacy awareness training annually. We also provide coworkers with additional cybersecurity training through online offerings, company broadcasts and security awareness events. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The cybersecurity program is being enhanced to ensure that critical vendors and other third-parties are risk assessed prior to being given access to the Company's information assets and networks. Additionally, processes are currently in place to review existing third-party access to systems that have a material impact on the financial statements of the Company.


text: The Audit and Risk Committee, a committee of the Company's Board of Directors, actively participates in discussions with management regarding cybersecurity risks and receives quarterly reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Audit and Risk Committee reviews key cybersecurity risks, on a quarterly basis, to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Audit and Risk Committee also meets quarterly in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Audit and Risk Committee has previously and will continue to attend cybersecurity awareness training events hosted by third-party cybersecurity experts.


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Audit and Risk Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Despite our cybersecurity governance program, we cannot assure you that we will be able to effectively prevent, detect or respond to all cybersecurity incidents, which may have a material adverse impact on our reputation and our results of operations.


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Cybersecurity, Technology and Innovation Committee (the "Committee") at least three times per year. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.


text: The Committee was formed in December 2024 and is responsible for cybersecurity, technology and innovation oversight previously performed by the Audit and Risk Committee. It is a committee of the Company's Board of Directors that actively participates in discussions with management regarding cybersecurity risks and receives periodic reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Committee reviews key cybersecurity risks at least three times per year to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Committee also meets at least three times per year in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Committee will attend cybersecurity awareness training or other educational events presented by third-party cybersecurity experts.


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cyber Risk Management and Strategy Our cyber risk management and strategy has been incorporated into our compliance and risk management program across a number of verticals. For example, information security risk assessments are performed across our business processes, including, but not limited to, third-party services, vendors and systems that process sensitive data. We undergo external annual penetration assessments to evaluate susceptibility to attack, for example, through social engineering, application websites and system/network vulnerabilities. We aim to continuously evolve our information security program in response to the ever-changing landscape of best practices, industry-specific risks, company-specific risks, and potential threats. This evolution is also driven by validation tests in an effort to ensure our program remains robust and effective. In the wake of the October 2023 cybersecurity incident, we prioritized implementation of enhanced safeguards consistent with our incident response process and further fortifying our commitment to information security.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: We also have a process to evaluate third-party providers, which is designed to understand the potential risks and impact of threats to our supply chains as well as potential privacy risks associated with external data management. This process has multiple components and is designed to assess our providers performance across several domains, including data security, asset management, communications and operations management, access control, business continuity management, financial, and legal compliance.


text: Considering the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These engagements allow us to leverage specialized knowledge and insights, including leading industry practices, to better inform our cybersecurity strategies and processes. Our collaboration with these third parties includes audits, threat assessments, and consultations to enhance our security measures.


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, and a SOC1 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.


text: Governance Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principle responsibility in this domain is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Information Officer who has approximately 20 years of experience leading technology and product engineering functions.


text: Our Enterprise Risk Committee reviews and discusses cybersecurity, information security and data privacy risks at regular intervals. A quarterly Enterprise Risk Committee meeting is chaired by our Chief Risk and Compliance Officer and includes information security briefings led by the Chief Information Security Officer.


text: We also hold quarterly Audit and Risk Committee meetings, during which our Board of Directors receives briefings on information security matters. Risks that are identified during these processes are reviewed by executive leadership and corrective action plans are established to address and manage the issues, as applicable and appropriate.


text: We believe in a proactive approach to enterprise risk management. A major tenet of our cybersecurity program includes training to educate and inform team members on cyber hygiene and threat management as well as regular testing to check for understanding. We have invested in technology and dedicated internal resources to facilitate training for application developers, conduct tabletop exercises, run anti-phishing campaigns, and train on privacy regulations. These training activities, along with other key risk indicators, are tracked and reported to our Enterprise Risk Committee on a quarterly basis.


text: Recent Cybersecurity Activity As previously disclosed on a Form 8-K dated November 2, 2023, as amended by the Form 8-K/As dated, November 9, 2023, and December 15, 2023, on October 31, 2023, we experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems and obtained personal information relating to substantially all of our current and former customers. Following detection of this incident, we initiated response protocols that included deploying containment measures involving shutting down certain systems as a precautionary measure. We notified law enforcement, regulatory authorities, and other stakeholders. We worked with our existing cybersecurity firms and retained additional cybersecurity experts to support our actions.


text: Our engagement with law enforcement and regulators, and defense of litigation is ongoing. To assist our customers, we have offered identity protection services, including credit monitoring, to all of our current and former customers for two years.


text: The cybersecurity incident did not result in a misstatement to the interim consolidated financial statements previously filed or included in this Annual Report on Form 10-K. In addition, while we cannot presently quantify the full extent of remediation and legal expenses associated with this cyber-attack, we do not believe the incident has materially affected or is reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, a SOC1 audit and a SOC2 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.


text: Governance Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principal accountability in this domain is placed with our Chief Information Security Officer, who has approximately 25 years of experience in cybersecurity program design and implementation. Responsibility is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Innovation and Digital Officer who has approximately 20 years of experience leading technology and product engineering functions.


text: Risk Management and Strategy We have developed and implemented various processes to oversee and manage the cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including but not limited to: employing appropriate incident prevention and detection software where appropriate; employing industry-standard encryption protocols where appropriate; conducting regular vulnerability scans; applying patches in a timely manner; conducting penetration tests and implementing recommended corrective actions in a timely manner; maintaining a well-defined incident response plan and supporting procedures; conducting regular phishing simulations and tabletop exercises; and requiring employees to complete cybersecurity training.


text: Engaging Third Parties on Risk Management We collaborate with vendors, service providers, assessors, auditors, consultants, and other third parties on an as-needed basis to develop secure informational and operational technology systems and protect against cybersecurity threats. For example, we engage third-party security experts to conduct risk assessments and program enhancements, including vulnerability assessments, cybersecurity tabletop exercises, and internal and external penetration tests.


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties, and incorporating third-party risk into our incident response plans.


text: Material Impact from Cybersecurity Incidents While we have experienced and will continue to experience varying cyber incidents in the normal conduct of our business, thus far to our knowledge, such incidents have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Cheif Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).


text: Monitor Cybersecurity Incidents Our internal cybersecurity control group meets on a monthly or more frequent basis to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness. Moreover on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.


text: Risk Management and Strategy We have developed and implemented various processes to oversee and manage cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss, and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties and incorporating third-party risk into our incident response plans.


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Chief Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).


text: Monitor Cybersecurity Incidents Our internal cybersecurity control group meets monthly or on a more frequent basis if needed, to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal control group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness. Moreover, on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.


text: The Company maintains robust processes for identifying, assessing and managing cybersecurity threats. Cybersecurity threats are prevented and detected by the Company's security operations center using multiple approaches, including perimeter defense, vulnerability management, intrusion testing, asset management, multifactor authentication and data protection. The Company leverages third parties in its cybersecurity activities, including threat awareness, penetration testing and routine program assessments.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: The Company has in place a documented cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Cybersecurity threats and incidents are analyzed by the security operations center and based on the severity of the event, promptly reported by the Chief Information Security Officer to the Vice President Compliance & Audit to initiate cross-functional response team support. The role of the response team includes evaluating compliance with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. As part of the Company's documented response plan, management members of the Board of Directors, who represent a majority of the Board of Directors and who have been delegated responsibility for cybersecurity, are notified of significant cybersecurity events and provide strategic direction through the incident response and communication. The management members of the Board of Directors are regularly briefed on cybersecurity threats relevant to the Company as well as the Company's cybersecurity program, incident response and remediation efforts. The Company's cyber incident response plan is tested periodically through third-party conducted executive and technical tabletop exercises. A summary report identifying strengths and areas for improvement is provided to tabletop exercise participants and utilized by the Company to enhance its response plan.


text: The Company also manages cybersecurity threats through its proactive risk management program and cybersecurity awareness program, which have been integrated with the Company's overall risk management process. That is, material risks from cybersecurity threats, including those associated with the Company's use of third-party service providers, are assessed during the Company's annual review of its enterprise risks, during which leaders discuss the Company's overall risk profile, inventory material risks, and map management activities and corporate initiatives to each risk. The Company's cybersecurity awareness program includes policies regarding information security and data protection and cybersecurity training. Policies and training are periodically reviewed by a cross-functional committee of management. Training is provided to employees and contractors annually.


text: The Company relies on technology in all aspects of its business, including information systems of its third-party service providers. The information systems upon which the Company depends have been, and will likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. The Company's dependence exposes it to cyberattacks, both directly and through cyberattacks impacting its service providers. A significant cybersecurity incident at the Company or its service provider could result in service interruptions, safety failures, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, the Company continuously monitors its cybersecurity threats, including risks associated with its user of service providers. The Company is not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected the Company's business strategy, results of operations or financial condition.


text: The Company has in place a documented cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Cybersecurity threats and incidents are analyzed by the security operations center and based on the severity of the event, promptly reported by the Chief Information Security Officer to the Vice President Compliance & Audit to initiate cross-functional response team support. The role of the response team includes evaluating compliance with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. As part of the Company's documented response plan, management members of the Board of Directors, who have been delegated responsibility for cybersecurity, are notified of significant cybersecurity events and provide strategic direction through the incident response and communication. The management members of the Board of Directors are regularly briefed on cybersecurity threats relevant to the Company as well as the Company's cybersecurity program, incident response and remediation efforts. The Company's cyber incident response plan is tested periodically through third-party conducted executive and technical tabletop exercises. A summary report identifying strengths and areas for improvement is provided to tabletop exercise participants and utilized by the Company to enhance its response plan.


text: Risk Management Strategy Our cybersecurity risk management strategy is comprised of several key elements and is overseen by our Global Information Security team ("GIS"), which is incorporated into our Enterprise Risk Management ("ERM") function. The oversight of our cybersecurity risk is integrated into our ERM processes and procedures. Our ERM framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities, and risk management strategy. We leverage a variety of risk methodologies and technologies to mitigate the risk of cybersecurity threats and incidents. We have a multi-layer, in-depth approach to technology solutions, including employing applications and tool suites used for perimeter, network, end point and application security, as well as for data recovery, in each case tailored to our systems, data, risk profile and mitigation strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall cybersecurity strategy.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats. We have also taken steps to address cybersecurity threats at third parties, including service providers, that handle, possess, process, and store our material information. Our Third-Party Risk Management program requires that these third parties maintain certain security controls and we assess their compliance with these requirements.


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate systems), and test that awareness using knowledge assessments and simulations. The training is administered to employees on an annual basis, and we use a third-party provider for the content to ensure that the training is periodically updated to incorporate new cybersecurity-related developments and best practices.


text: In the event of a reported potential cybersecurity incident, GIS determines whether such incident triggers our cybersecurity threat evaluation and response plan (the "Response Plan"). If triggered, our cybersecurity response team, which includes representatives from GIS, our business team, and executive leadership, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team are responsible for developing, recommending and implementing the necessary measures to address the cybersecurity incident, including assessing, containing and mitigating its impact, notifying members of our management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The Cyber Response Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.


text: Our cybersecurity policies, standards, processes, controls, and practices are periodically assessed by third-party consultants. These assessments address a variety of activities including information security maturity assessments, audits, regulatory compliance assessments, and independent reviews of our information security control environment and operating effectiveness. The results of assessments are reported to the Board and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: GIS oversees our cybersecurity program and is responsible for identifying, assessing, monitoring, managing and communicating our cybersecurity risks. GIS is led by our Chief Information Security Officer ("CISO") and is comprised of information security professionals with a variety of cybersecurity certifications and accreditations. GIS is aided by the Executive Risk Management Committee, which is comprised of senior leaders and subject matter experts throughout our company, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), who serve on the committee to assess and mitigate specific business unit risks, promote an understanding of potential issues, and provide risk resolution and prevention support. GIS and the Executive Risk Management Committee are responsible for keeping the Audit Committee apprised of developments with respect to our cybersecurity strategy and risks.


text: Our CISO has served in various roles in information technology and information security for more than 30 years, including serving as the Chief Information Security Officer at two other large public companies and has been with ACI since 2015. Our CCO has over 30 years of experience in compliance program leadership and process design, risk management and financial services operations, including serving as Head of Compliance for several banking and financial services technology organizations including two other publicly traded companies.


text: The Audit Committee oversees our cybersecurity strategy and risks. The Audit Committee is provided with cybersecurity strategy and risk updates on a quarterly, or as needed, basis. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.


text: Risk Management Strategy The oversight of our cybersecurity risk is integrated into our Enterprise Risk Management ("ERM") function and processes and procedures. Our ERM framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities, and risk management strategy. We leverage a variety of risk methodologies and technologies to mitigate the risk of cybersecurity threats and incidents. We have a multi-layer, in-depth approach to technology solutions, including employing applications and tool suites used for perimeter, network, end point and application security, as well as for data recovery, in each case tailored to our systems, data, risk profile and mitigation strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall cybersecurity strategy.


text: In the event of a reported potential cybersecurity incident, the Global Information Security team ("GIS") determines whether such incident triggers our cybersecurity threat evaluation and response plan (the "Response Plan"). If triggered, our cybersecurity response team, which includes representatives from GIS, our business team, and executive leadership, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team are responsible for developing, recommending and implementing the necessary measures to address the cybersecurity incident, including assessing, containing and mitigating its impact, notifying members of our management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The Cyber Response Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations or financial condition, but we cannot assure that our business strategy, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future cybersecurity incidents.


text: Our Chief Information Security Officer ("CISO") leads GIS, and together with our Chief Compliance Officer ("CCO") are responsible for managing and assessing cybersecurity risk and strategy. They oversee our cybersecurity program and are responsible for identifying, assessing, monitoring, managing and communicating our cybersecurity risks. GIS is comprised of information security professionals with a variety of cybersecurity certifications and accreditations. GIS is aided by the Executive Risk Management Committee, which is comprised of senior leaders and subject matter experts throughout our company, including our CISO and CCO, who serve on the committee to assess and mitigate specific business unit risks, promote an understanding of potential issues, and provide risk resolution and prevention support. GIS and the Executive Risk Management Committee are responsible for keeping the Audit Committee apprised of developments with respect to our cybersecurity strategy and risks.


text: Our CISO has served in various roles in information technology and information security for more than 30 years, including 20 years in Financial Services, along with serving as the Deputy Head of Global Information Security at ACI prior to being designated as CISO and has been with ACI since 2008. Our CCO has served in various risk and compliance roles in both global and regulated entities within financial services technology organizations, along with serving as the Head of Enterprise Risk at ACI prior to being designated as CCO and has been with ACI since 2022. The CCO's expertise focuses on designing, maturing, and embedding risk and compliance frameworks; credentials also include a Juris Doctor, a Masters of Business Administration with a focus in Finance and emphasis in consulting, and a Bachelors of Science in Business Administration.


text: Risk Management and Strategy We understand the importance of cybersecurity in maintaining the confidentiality, integrity, and availability of our systems and data. Our business operations leverage information technology infrastructure and third-party vendors and systems which makes us susceptible to various cyber threats. We have implemented a comprehensive cybersecurity risk management program to mitigate these risks and safeguard our assets.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: We have measures in place to prevent, detect, and manage material risks from unauthorized access to our electronic information systems. These include various controls, technologies, and processes that protect confidential, proprietary, business and personal information that we collect, process, store, and transmit as part of our business operation.


text: We also consider cybersecurity, along with other business risks, within our enterprise risk management framework. Our assessment, identification and management of cybersecurity and data privacy risks are reported as part of our regular enterprise risk assessments, security audits and risk management programs. In addition, we leverage recognized consulting firms to conduct application security and penetration testing assessments annually. We also require employees with access to information systems, including all corporate employees, to undertake cybersecurity training and compliance programs annually.


text: Our cybersecurity program utilizes the National Institute of Standards and Technology framework along with risk-based analysis and judgment, to choose the most effective security controls to address potential risks. We consider various factors such as likelihood and severity of risk, impact on our organization and others if a risk materializes, feasibility and cost of controls, and the effects of controls on our operations and others.


text: Because we rely on third-party providers and platforms for many of our computer and technology systems and support, we use a variety of processes and tools to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring. As a part of our monitoring, we regularly obtain System Organization and Control Reports (SOC Reports) for key third-party financial systems.


text: As part of our overall strategic initiatives, we have made significant investments in internal and external resources to support and enhance our technology infrastructure over the next several years. As part of this technology transformation, we plan to continue growing our information security team, enhance our cyber response plan and data privacy policies and evolve our procedures around third-party risk management.


text: No material cybersecurity incidents occurred in fiscal 2023, but future incidents cannot be predicted. Additionally, in " Item 1A. Risk Factors " under the heading "Cybersecurity and Technology Risks," forward-looking cybersecurity threats that could have a material impact on our business are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Although we have operational safeguards in place, we still face significant risks from cybersecurity threats, as the number of cyberattacks targeting retailers and corporate networks grows, and the volume, intensity and sophistication of attempted attacks, intrusions, and threats from around the world increase daily. We (and third parties upon whom we rely) may be unable to implement security controls fully, continuously, and effectively as intended. As described above, we utilize a risk-based approach that focuses on proactively preventing security risks followed by prompt detection and containment of risks identified. Security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. In addition, events, when detected by security tools or third parties, may not always be immediately understood or acted upon. If our technology systems, networks, or information are compromised by malicious software, ransomware, or other cyberattacks, we could lose critical data or confidential information of our customers, vendors or associates, experience disruptions in our ability to distribute and sell merchandise and manage inventories, incur substantial remediation costs and/or become subject to negative publicity, costly government actions or litigation.


text: Notwithstanding the deliberate approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Our Audit Committee, which includes a member with cybersecurity experience, oversees our management of risks relating to information security and data privacy. At least semiannually, the Audit Committee is responsible for reviewing and discussing our risk exposures related to information security and data privacy with management. These management updates are designed to inform the Audit Committee of any potential risks relating to information security or data privacy and any relevant mitigation or remediation tactics being implemented. In addition, as part of our regular enterprise risk management assessments, cybersecurity risks are reported to and assessed by the Enterprise Risk Committee, comprised of senior leadership from key business functions.


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for our overall information security, cyber risk, and business continuity. The CISO brings over 25 years of extensive experience in information technology and information security and serves as the designated executive leader for cyber or data-related incident response activities. Our CISO's experience includes leading cybersecurity programs for Fortune 100 companies. In addition to the CISO, the Chief Information Officer and Chief Legal Officer are responsible for overseeing risks related to cybersecurity and data privacy. Our Chief Information Officer's experience includes more than 25 years of leading all information technology strategies and operations and oversight of IT systems for various Fortune 100 companies, and our Legal Department has personnel specializing in data privacy and cybersecurity who assist our team in assessing and managing cybersecurity risks.


text: We have a Cybersecurity Incident Response Plan that is integrated into our crisis management program. The plan provides protocols for evaluating and responding to cybersecurity incidents, including incident disclosure and reporting, notification to senior management and relevant committees, and meeting external reporting obligations. The plan is reviewed and updated regularly by our CISO and Chief Legal Officer to ensure its continued effectiveness. We recently performed tabletop exercises where we performed walkthroughs of cyber incident situations to test our response plan. We plan to continue testing on a periodic basis going forward.


text: As part of our overall strategic initiatives, we have made investments in internal and external resources to support and enhance our technology infrastructure over the next several years. As part of this technology transformation, we plan to continue to invest in our information security team, enhance our cyber response plan and data privacy policies and evolve our third-party risk management program. In addition, in connection with our strategic review of the Family Dollar business, we are conducting a comprehensive reassessment of our cybersecurity posture. This evaluation focuses on how these changes affect our people, processes, and technologies. By doing this, we ensure the ongoing protection of sensitive data and critical assets, while also maintaining alignment with our security standards.


text: No material cybersecurity incidents occurred in fiscal 2024, but future incidents cannot be predicted. Additionally, in " Item 1A. Risk Factors " under the heading "Cybersecurity and Technology Risks," forward-looking cybersecurity threats that could have a material impact on our business are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: We have a Cybersecurity Incident Response Plan that is integrated into our crisis management program. The plan provides protocols for evaluating and responding to cybersecurity incidents, including incident disclosure and reporting, notification to senior management and relevant committees, and meeting external reporting obligations. The plan is reviewed and updated regularly by our CISO and Chief Legal Officer to ensure its continued effectiveness. We periodically perform tabletop exercises where we conduct walkthroughs of cyber incident situations to test our response plan, and we plan to continue testing on a periodic basis going forward.


text: Risk Management and Strategy DTE Energy maintains cybersecurity measures designed to protect its physical and digital infrastructure in order to provide safe and reliable delivery of energy to customers. These measures serve to maintain compliance with regulations and protect the confidentiality, integrity and availability of confidential and proprietary information, DTE Energy's computing resources, and the electrical and gas systems.

companyName: DTE Electric Co


text: To protect against cybersecurity threats, DTE Energy employs a dedicated cybersecurity team led by the Chief Information Officer. The cybersecurity team is responsible for implementing proper safeguards to mitigate the risk of cyber threats, including but not limited to firewalls, continuous monitoring, and training. DTE Energy also engages with third parties to conduct cybersecurity maturity assessments to provide an independent and objective view of our cybersecurity and assess opportunities for improvement. The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is the basis for these assessments to manage cyber risks, mature and monitor existing security controls, and communicate security posture coherently. The NIST CSF provides a common language to understand, manage, and express cyber risks internally and externally.


text: Another component of DTE Energy's cybersecurity team is the Cybersecurity Defense Center (CSDC), which has the primary responsibility for monitoring and responding to cybersecurity incidents. The CSDC maintains an incident response plan designed to protect against, detect, evaluate, and respond to and recover from a cyber incident. The CSDC may receive incident reports from DTE Energy employees, corporate security, or external sources. The incident response plan is intended to be flexible so it may be adapted to an array of potential scenarios. Depending on the incident, the CSDC may decide to engage external resources for assistance with responding to the incident. DTE Energy regularly conducts exercises to help ensure the plan's effectiveness and overall preparedness.


text: DTE Energy engages third-party service providers to assist with managing various aspects of its business. These service providers are subject to due diligence reviews of their information security programs prior to onboarding. DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law. Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data. DTE Energy collaborates with its service providers to help determine whether their information security protocols are sufficient and monitors their compliance with DTE Energy security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.


text: The CSDC monitors and responds to actual and potential compromises from third-party service providers. Access from a potentially compromised third-party is restricted until DTE Energy receives confirmation the compromise has been mitigated.


text: As of December 31, 2023, cybersecurity risks have not materially affected the Registrants' business strategy, results of operations, or financial condition.


text: DTE Energy has an enterprise risk management program to reduce overall risk, including risks related to cybersecurity, through comprehensive risk assessments and execution of corresponding mitigation plans. Risks are reported and managed through various internal committees, which meet regularly and report at least annually to the Board of Directors. These committees include: • The Risk Management Committee (RMC) is chaired by the Chief Executive Officer and comprised of the Chief Financial Officer, Chief Legal Officer, General Auditor, and other senior officers. The RMC directs the development and maintenance of comprehensive risk management policies and procedures. The RMC also sets, reviews, and monitors risk limits for enterprise-level risk and other exposures • The Operational Risk and Resilience (ORR) Committee is chaired by the President and Chief Operating Officer and comprised of operational leaders in DTE Energy's business units. The ORR is responsible for managing operational risks including safety, reliability, and cybersecurity at DTE Energy's generation plants, substations, and other operating sites • The Technology Cybersecurity Committee (TCC) is a sub-committee of the ORR that focuses on information and operational technology risks related to cybersecurity, chaired by operational leaders in DTE Energy's business units and includes the Chief Information Officer Members of the Board of Directors serve roles on various committees responsible for their respective oversight and risk management. The Audit Committee of the Board of Directors, comprised solely of independent directors, is responsible for reviewing DTE Energy's cybersecurity risks, the results of any cybersecurity risk assessments and audits, and reports of investigations into significant events presented by DTE Energy's IT department. The Audit Committee reports to the Board of Directors and may include any significant matters involving cybersecurity within its reporting. All members of the Board of Directors, including the Audit Committee, have either managerial knowledge or working knowledge of technology and cybersecurity matters.


text: DTE Energy's Chief Information Officer leads the cybersecurity team and has responsibility for assessing and managing cybersecurity risks. The Chief Information Officer has held this position for over 10 years and has decades of experience in IT, including oversight of information protection security (IPS). The IPS cybersecurity team is also led by two full-time directors with over 40 combined years of industry experience, including (1) the director of cybersecurity operations responsible for the CSDC, identity and access assurance, and cloud security and (2) the IPS director of cybersecurity governance, risk, and compliance who is also responsible for engagement and outreach to internal and external stakeholders.


text: The Chief Information Officer provides regular updates to the Audit Committee and senior leaders regarding DTE Energy's management of cyber risks, including but not limited to the status of various training metrics to safeguard against phishing, malware, and other cyber threats. The Chief Information Officer also provides an annual cybersecurity update directly to the Board of Directors. If cybersecurity risks arise, the CSDC executes the incident response plan and communicates the appropriate details to executive management, the Board of Directors, or any related committees.


text: A cybersecurity incident may also require various levels of external reporting. The CSDC coordinates with the legal department and controller's organization in reporting incidents externally. Depending on the nature of the incident, reporting may be required to various federal and state government agencies. DTE Energy has forged trusted partnerships with such agencies and with other companies and organizations to share best practices, tools, and threat information. This includes partnering with others in the utilities industry to form the Electricity Subsector Coordination Council (ESCC). The ESCC is the principal liaison between the energy sector and the federal government in coordinating efforts to prepare for and respond to any threats to critical infrastructure.


text: DTE Energy engages third-party service providers to assist with managing various aspects of its business. These service providers are subject to due diligence reviews of their information security programs prior to onboarding. DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law. Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data. DTE Energy collaborates with its service providers to help determine whether their information security protocols are sufficient. If a service provider experiences a cyber incident, DTE Energy monitors their compliance with our security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.


text: DTE Energy has experienced, and expects to continue to be subject to, cybersecurity threats and incidents. As of December 31, 2024, cybersecurity risks have not materially affected the Registrants' business strategy, results of operations, or financial condition. For additional discussion of the risks related to cybersecurity threats and incidents, see Item 1A. "Risk Factors."


text: DTE Energy's Chief Information Officer leads the cybersecurity team and has responsibility for assessing and managing cybersecurity risks. The Chief Information Officer has held this position for over 10 years and has decades of experience in IT, including oversight of information protection security (IPS). The IPS cybersecurity team is also led by two full-time directors with over 40 combined years of industry experience, including (1) the director of cybersecurity operations responsible for the CSDC, identity and access assurance, and cloud security and (2) the IPS director of cybersecurity strategy, risk, and engagement who is also responsible for engagement and outreach to internal and external stakeholders.


text: We believe cybersecurity is critical to advancing our 21st Century Security vision and enabling our digital transformation efforts. As an aerospace and defense company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we are a leader in the information security field, and we expend considerable resources on cybersecurity.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Classified Business and Security Committee of the Board of Directors is briefed by senior leadership, as appropriate, on the cybersecurity of classified programs and the security of our classified business supply chain. Other than oversight of classified business cybersecurity, the full Board retains oversight of cybersecurity because of its importance to Lockheed Martin and the heightened risk in the aerospace and defense industry. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. The corporate information security organization manages and continually enhances a robust enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our computer incident response team (CIRT), which is responsible for the protection, detection and response capabilities used in the defense of Lockheed Martin's data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.