text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Cyber Oversight Group utilizes the IRP to: (1) prepare for and protect against cybersecurity incidents; (2) identify and analyze cybersecurity incidents; and (3) contain, eradicate, and help ensure appropriate reporting of cybersecurity events. In the event of a cybersecurity incident, the IRP provides a framework to coordinate the response. The IRP also addresses escalation protocols to senior management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate. We also manage threats to our systems originating or associated with third party service providers by integrating cybersecurity requirements and other provisions into various contracts. Vulnerabilities and risks identified for our third-party vendors are handled through ongoing scanning and reviews.


text: We employ a variety of measures to prepare for and protect against, detect, and contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures we have in place include, without limitation, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, and annual cybersecurity awareness trainings for our employees as well as social engineering awareness simulations. To detect and analyze cybersecurity incidents, our cybersecurity program uses automated event-detection technology monitored by our cyber defense team, notifications from employees, vendors or service providers, and other tools. Once a potential cybersecurity incident is detected, our IRP sets forth the process we follow to investigate the potential incident and contain it. After the cybersecurity incident is contained, our focus shifts to remediation, eradication, and recovery, with such efforts dependent upon on the nature of the cybersecurity incident. We have relationships with a number of well-established third-party service providers to assist with cybersecurity incident response, containment and remediation efforts. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity incidents that impact our own systems, networks, and technology. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA

secItem: Item 1C


text: Cybersecurity Risks We are currently not aware of any material cybersecurity incidents or threats that have impacted the Company or our business, financial condition, results of operations, employees or customers in the past three years. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems, including digital ordering solutions through which more than 85% of our domestic sales originate. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third party providers, will prevent breakdowns or incidents affecting our or our third party providers' databases or systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—Disruptions of our critical business or information technology systems could harm our ability to compete and conduct our business" and "—Failure to maintain the integrity of internal or customer data could result in damage to our reputation, loss of sales, and/or subject us to litigation, penalties or significant costs."


text: Cybersecurity Risk Management and Strategy Cybersecurity is a critical risk to our business. We rely on complex information technology systems and networks to conduct business, including communicating with employees and our distribution centers, ordering and managing materials from suppliers, selling and shipping products and analyzing and reporting results of operations, as well as for storing sensitive, personal and other confidential information. While we employ resources to monitor and protect our technology infrastructure and sensitive information, these security measures or those of our third-party vendors may not prevent all attempted security breaches or cyber-attacks. If our or our third-party vendors' information technology systems are damaged or cease to be available or function properly for an extended period of time, whether as a result of a significant cyber incident or otherwise, our ability to communicate internally as well as with our customers could be significantly impaired, which may adversely impact our business. Our acquisition strategy may also result in exposure to certain technology risks during integration of systems of acquired companies to our existing platform.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Addressing cybersecurity risks requires ongoing monitoring and vigilance, and the Company is making enhancements to its cybersecurity policies, procedures and practices to safeguard sensitive information as well as information from our partners, customers and employees. We employ a risk-based strategy focused on safeguarding critical assets by implementing controls around access, data, and infrastructure security to protect the confidentiality, integrity, and availability of our data. Maturation and refinement of the Company's cybersecurity risk management strategy and related procedures is a continuous activity to ensure appropriate identification, assessment, and response to risks from cybersecurity threats that may adversely impact our operations. Our employee training and awareness programs are in place to improve cybersecurity awareness throughout the organization and we are committed to educating our employees on best practices for data protection and phishing awareness. We also engage with third-party cybersecurity assessors, consultants, and auditors that provide independent assessments of our systems and processes, contributing to our efforts to strengthen our cybersecurity posture and enhance our defenses.


text: On January 31, 2022, certain of our computer systems related to the Aurora acquisition that had not yet been integrated into our main systems were the victim of a cybersecurity attack. We immediately took steps to isolate those systems and implemented measures to prevent the spread of the attack, including taking systems offline in an abundance of caution. Together with an outside cybersecurity forensics firm, we investigated the attack to determine its nature, scope, duration, and impacts, as well as our vulnerability to another such attack and whether there was any exfiltration or misappropriation of data. There was no evidence that the attack extended beyond the Aurora acquisition's systems, and it was determined that no critical data was accessed. We have subsequently taken steps to integrate the acquisition's systems with our main systems, which we expect to complete in the first half of 2024.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. We maintain cyber insurance coverage to supplement our cybersecurity program given the complex and evolving nature of global cyber threats; however, the insurance may not be sufficient to cover all losses from any breaches of our systems and does not extend to reputational damage or costs incurred to improve or strengthen systems against future threats or activity. Given the increasing sophisticated threats, a disruption from a cybersecurity incident is possible to occur and we are actively taking actions to minimize the likelihood and impact of such incidents. In the event of such an incident, our information security team is continuously engaged to investigate and respond, including isolating systems, performing forensics, containing and eradicating malicious activity, and recovering systems in-line with business expectations and operations.


text: Cybersecurity Governance Our Board of Directors oversees the cybersecurity risk management program and is regularly informed of cybersecurity risks through periodic updates provided by the Director of Information Technology ("IT"), to address our cybersecurity processes and risk mitigation efforts. Certain Board of Directors have cybersecurity risk certification credentials and experience with, and exposure to, cyber risk oversight. The periodic updates provided by management to the Board of Directors generally encompass emerging cyber threats, the Company's security posture changes, significant cybersecurity incidents, progress of risk mitigation efforts, and cybersecurity strategies and investments. The frequency of these updates allows for timely decision-making and ensures that our Board is fully informed of our cybersecurity risks.


text: Our Director of IT is responsible for identifying, assessing, and mitigating cybersecurity risks across the Company. Supported by our Information Security team, the Director of IT monitors the cyber threat landscape, plans and implements security controls, and responds to incidents. The collective team has extensive experience in information security and cybersecurity risk management and performs detection and monitoring of cybersecurity threats and incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes.


text: Cybersecurity Risk Management & Strategy PetIQ has implemented and maintains various information security processes and systems designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: PetIQ, Inc.


text: Our cybersecurity function, led by our Cybersecurity Manager and supported by our Chief Information Officer ("CIO") and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. This group identifies and assesses cybersecurity threats by monitoring and evaluating our threat environment using various methods including: using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external cybersecurity audits, engaging third-party threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and completing third-party red/blue team exercises and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, practices and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: incident management processes (for both internal and third-party hosted systems), maintaining certain security certifications, encryption of certain data, network security controls, access controls, physical security, asset management (such as tracking and disposal), systems monitoring, vendor risk management processes, employee training, penetration testing, dedicated cybersecurity staff, and cybersecurity insurance.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including threat intelligence service providers, cybersecurity software and managed cybersecurity providers, penetration testing firms, and forensic investigators.


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers and data/computing hosting companies. We have a vendor management program that, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. This vendor management program includes a security questionnaire, reviews of security assessments, and vulnerability scans related to the vendor, as well as the imposition of contractual obligations related to cybersecurity.


text: At PetIQ, cybersecurity is an overall company risk that is managed as a part of the Enterprise Risk Management Program which is updated and reviewed quarterly and is overseen by both senior management and the Board of Directors. For a description of the risks from cybersecurity threats that may materially affect PetIQ and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: PetIQ's Board of Directors is responsible for overseeing the Company's cybersecurity risks and threats. Specifically, the Audit Committee of the Board of Directors reviews the Company's cybersecurity status, risks, and threats periodically. Additionally, as needed, individual board members may reach out to Company management directly with cybersecurity questions or clarifications.


text: PetIQ has implemented cybersecurity processes and procedures in coordination with cybersecurity risk mitigation tools and services designed to help prevent, detect, and eradicate cybersecurity incidents. The CIO, who has more than 30 years of IT experience, has overall accountability for cybersecurity. The Cybersecurity Manager reports to the CIO. The Cybersecurity manager, who has overall responsibility for assessing and managing cybersecurity risk as well as managing and monitoring the cybersecurity technology stack, has more than 20 years of IT experience and is an ANSI/EC-Council certified CISO.


text: PetIQ's cybersecurity incident management processes include processes to assess the impact of an incident for reporting purposes, as well as escalation procedures for incidents (based on severity, risk, and impact) that can flow communications and decisions up through the CIO, Executive/Senior Leadership, and the Audit Committee of the Board of Directors as needed.


text: Risk management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the Company. Our information technology team oversees and implements a range of tools and services designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data. These tools and services include, from time to time: • monitoring emerging data protection laws and best practices regarding application security, access management, device protection, network management, and data loss prevention and recovery and implementing responsive changes to our processes; • undertaking periodic reviews of our partner-facing policies and statements related to cybersecurity; • utilizing intrusion detection and monitoring applications and multifactor authentication; • conducting periodic table-top exercises with management, including our Executive Director, Corporate Information Systems, and testing of our data security, incident response policies and procedures; • conducting periodic cybersecurity management and incident training for employees, including simulated phishing campaigns, which provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses; and • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care.

companyName: Vericel Corp

ticker: VCEL


text: We also maintain an enterprise-wide incident response plan designed to secure the enterprise, mitigate the impact of a cybersecurity incident, recover and restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. Management, including our Executive Director, Corporate Information systems, collaborates with our information technology team and technical partners to review at least annually our enterprise-wide incident response plan. Periodically, we engage assessors, consultants, auditors and other third parties, including by conducting exercises with an external partner to stress test our data security systems and practice company-wide response tactics. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, and third-party risks are included within our enterprise risk management program. In the event of a suspected or actual cybersecurity event, we have partnered with a globally recognized digital forensics investigation firm and outside counsel to provide services and support on a real-time basis to analyze any breach and secure both our data and information systems.


text: For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see "Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business," which is incorporated by reference into this Item 1C.


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents. This includes penalties and settlements, of which there were none.


text: The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives.


text: The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board's legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022 and 2023 in overseeing the development of the Company's Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.


text: Our Executive Director, Corporate Information Systems, along with our General Counsel, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our Executive Director, Corporate Information Systems, has served in this role for two years and has access to Vericel's external information security firm and an industry-leading intelligence platform. This Executive Director manages and leads the internal Information Technology team to maintain and update the company's technology infrastructure and corresponding safety measures.


text: Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our General Counsel works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and align our security program closely to the NIST Cyber Security Framework. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: As of the date of this Annual report on Form 10-K, we have not been materially impacted by any identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on such risks, see Item 1A, "Risk Factors - Business and Operational Risks - If we or our third-party service providers suffer a cybersecurity event, our reputation may be harmed, we may lose clients and we may incur significant liabilities, any of which would harm our business and results of operations."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its overall enterprise risk oversight function and has delegated to the Audit Committee primary oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Information Security Officer regularly briefs the Audit Committee on our cybersecurity program and threat posture. These sessions may address a wide range of topics including recent developments, emerging threats, vulnerability assessments, third-party and independent reviews, and information security considerations arising with respect to our vendors and other third parties.


text: The Audit Committee periodically reports to the full Board regarding its activities, including in relation to its oversight of cybersecurity risks. The full Board also discusses cybersecurity matters with management at least annually.


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has over 95 years of combined experience in IT and cybersecurity matters.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: We assess, identify and manage risks from cybersecurity threats through our Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors (the "Audit Committee") and is managed by our Chief Information and Digital Officer ("CIO") and a dedicated Chief Information Security Officer ("CISO"). Our current CISO has over 10 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as a Global Director of Information Security at another global high-tech manufacturing company. The CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial N.V.

ticker: CNH


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability These include the ongoing monitoring of our systems, including with the assistance of third party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2023. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to the Company's global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the Chief Information and Digital Officer and CISO. In addition, on at least an annual basis, the Board receives reports, summaries or presentations from our Chief Information and Digital Officer and CISO related to cybersecurity threats, risk, mitigation and related processes.


text: The CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide for to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of our company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for our cybersecurity program and is a key member of the risk management function, reporting directly to the Chief Risk Officer ("CRO") and to the Enterprise Risk Committee of our Board of Directors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements: • Systems Safeguards. We adopt the "trust by design" framework when designing new products, services and technology. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. • Incident Response. We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. • Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness. • Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber attacks, and recovery and resilience tests. • Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled "We are subject to certain risks in connection with our use of technology."


text: Our Board of Directors considers cybersecurity risk as part of its risk management function and has delegated to the Enterprise Risk Committee oversight and governance of the technology program and the information security program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Enterprise Risk Committee reviews our cybersecurity risk profile on a quarterly basis. Additionally, our CISO and our Chief Information Officer provide quarterly reports to the Enterprise Risk Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: The Information Technology and Information Security sub-committee is a working group of the management level Enterprise Risk Management Committee and represented by managers within various departments and includes the CISO and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO and Deputy CISO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.


text: Our CISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The department, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience.


text: Risk Management and Strategy We recognize the importance of maintaining an integrated cybersecurity risk management system and view our responsibility for cybersecurity management as an enterprise risk, where we have adopted proactive and defensive safeguards. We maintain layered processes that place responsibility for management and mitigation of cybersecurity risks at both the management and Board level, which is modeled after the National Institute of Standards and Technology's cybersecurity framework, as more fully described below.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: We have not previously experienced a cybersecurity incident that has materially affected HGV, including our business strategy, results of operations, or financial condition. However, we cannot be certain that we will not experience such an incident in the future. For information on risks we face from cybersecurity threats, see "Our increasing reliance on information technology and other systems subjects us to risks associated with cybersecurity. Cyber-attacks or our failure to maintain the security and integrity of company, employee, associate, customer, or third-party data could have a disruptive effect on our business and adversely affect our reputation and financial performance" in Item 1A. Risk Factors.


text: Management Level Governance Our cybersecurity efforts are led by the Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"). The CISO has primary management-level responsibility for assessing and managing our cybersecurity program. The CISO reports to the CTO, who provides regular feedback to other members of the management team on managing material risks from cybersecurity threats.


text: Our CISO has over 25 years of experience in the field of cybersecurity. His background includes extensive experience as a technology consultant. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our CTO has extensive experience designing, developing, and utilizing technology products for security operation center services. His technical responsibilities spanned product security, privacy controls, data protection, and identity management. He has also overseen security operations, incident response, threat hunting, security intelligence, analytics, and technical fraud functions and worked with legal response teams at numerous companies, including serving as a Managing Director of a cybersecurity firm. He has advised chief information officers and consulted for boards of directors on cybersecurity related issues and attacks.


text: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program on information security. He is also responsible for keeping HGV apprised of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan.


text: This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board Level Governance The Audit Committee has primary Board-level responsibility for oversight of our cybersecurity and data protection risks. and serves as a liaison between management and the full Board. The Audit Committee receives regular reports from our CTO and CISO regarding the primary cybersecurity risks facing HGV, and the steps management is taking to mitigate such risks. The CISO and the CTO provide comprehensive briefings to the Audit Committee on a regular basis, generally at least once per quarter. These briefings include: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity incidents, if applicable; and • Compliance with regulatory requirements and industry standards.


text: The Audit Committee also reviews our cybersecurity management strategy and initiatives on a regular basis with our CTO and CISO. Both the Audit Committee and Board will promptly be made aware of any significant cybersecurity incident, as specified in our cybersecurity incident response plan.


text: Third-Party Engagement Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, to periodically evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the intention of keeping our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. The cybersecurity program also involves performance of tabletop exercises to test our incident response plan.


text: Third-Party Oversight We maintain processes in place to oversee, identify, and mitigate risks from cybersecurity threats related to third-party service providers, including conducting thorough security assessments of third-party service providers before onboarding. We also maintain ongoing compliance monitoring to oversee evolving cybersecurity risks. We generally include minimum information security requirements in our agreements with third-party service providers to address cybersecurity risks.


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: BGC Group, Inc.

ticker: BGC


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and supported by our business continuity teams.


text: We conduct periodic internal and external vulnerability audits and assessments and penetration testing and provide periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. We also participate in industry-specific cybersecurity roundtables and professional groups to ensure we remain abreast of industry-wide cybersecurity developments and best practices and thereby enhance our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for our business, we conduct various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with our conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with our business requirements and risk tolerances.


text: We maintain an incident reporting and escalation process in the event of any observed, detected, or suspected events that we believe may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Our processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Our incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. We determine the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on our business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by our cybersecurity team as well as other members of management and employees with specialized technology or financial knowledge, including our CISO, CIO, and CFO, as applicable. In the event of a material breach, we have a process for escalation to appropriate members of our senior management, and, where appropriate, to our Board and Audit Committee. These groups also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: We engage third parties from time to time that assist us in the identification, assessment, and management of cybersecurity risks. We also engage cybersecurity specialists to complete assessments of our cybersecurity processes, program and practices, including our data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs our overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 25 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities; our CIO, whose experience includes managing the technology professionals and processes at public and private financial services companies; and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Item 1A — Risk Factors — Risks Related to Our IT Systems and Cybersecurity."


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from U.S. and U.K. primary data centers. Either site alone is typically capable of running all of our essential systems. Replicated instances of this technology are maintained in our redundant data centers. Our data centers are generally built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards.


text: We conduct annual disaster recovery training exercises for each primary data center where failover procedures are tested against defined Recovery Time Objectives (RTOs).


text: Risk Management and Strategy We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology ("NIST")'s Cybersecurity Framework ("CSF") and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: We focus on people because we believe that one of the first lines of defense is our employees. All new employees are required to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. Our employees are required to annually re-affirm adherence to company-wide IT and related policies designed to secure a safe information and communications systems environment. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.


text: We focus on process, which includes policies, procedures and governance structures designed to help us identify, assess and response to cybersecurity risks. We have a written cybersecurity framework that closely aligns with NIST's CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer, the Chief Legal Officer, the Chief Operating Officer, the Chief Risk Officer, the Head of Investor Relations, and the Associate General Counsel. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plan against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company's assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST's CSF and the SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.


text: We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements (collaborating with service providers to help assess the sufficiency of their cybersecurity measures, and requiring service providers to notify us promptly of cyber incidents that may affect our systems or data).


text: Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities, implementing software patches in a timely manner and using other technology to promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.


text: To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition.


text: Our Board, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our Chief Information Security Office ("CISO") on, among other things, the threat landscape, the Company's cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company's overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2023 Form 10-K for additional information on our enterprise risk management.


text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team have also been instructed to elevate any potential cybersecurity issues, whether internal or at a third-party with whom we do business, to the CISO.


text: The Incident Response Team and the non-management employees who support the Incident Response Team are best positioned to identify, assess, respond to and galvanize both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team will notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation. A strong working relationship exists between the legal, accounting/finance, IT and business departments so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: We understand the importance of maintaining an active cybersecurity risk management and strategy program. As an emerging technology company, we understand that we may face cyber threats that range from common cyberattacks, such as ransomware, to more advanced attacks such as advanced persistent threats perpetrated by nation-state actors and other highly organized actors. Our cybersecurity risk management program is guided by industry standards, such as the National Institute of Standards and Technology ("NIST"). We strategically partner with industry leading external vendors to perform cybersecurity assessments, as well as regular penetration testing to better understand our potential vulnerabilities, threat vectors, and impact on critical assets or operations. As part of these processes, our cybersecurity team identifies and prioritizes risks to devise our annual cybersecurity mitigation strategy and address operational risks. Our cybersecurity program is organized around the following key areas:

companyName: Archer Aviation Inc.

ticker: ACHR


text: Risk Management and Strategy Insider Risk Management. We recognize that not all threats are external. We have an insider risk management program and are working to improve our data loss protection technology to protect our critical data.


text: Security Awareness Education. Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees.


text: Technical Safeguards. We have improved our endpoint security postures through the implementation of an Enterprise Mobile Management system, and continue to increase our investment in strengthening email, DNS, and other network security services.


text: Threat Detection and Response. In addition to aligning our cybersecurity risk management program to NIST standards, we have also engaged with third party providers of security information and event management and cybersecurity services to provide continuous monitoring and operational threat detection and response. Our partners integrate threat intelligence into their platforms, providing us with a proactive view of possible threats.


text: Incident Response. We have implemented a holistic review of incident response, with workflows in place for cybersecurity incidents, including provisions for assessing materiality, and defined escalation procedures.


text: Third Party Risk Management. To manage third-party risks, our cybersecurity team evaluates our partners, to provide an additional layer of scrutiny, and supervises and identifies material risks associated with the use of third-party service providers. These processes include a review of security controls and supplier contractual obligations for security and data protection requirements.


text: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including with respect to risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss, technology and cybersecurity risks and the risk assessment and risk management policies, practices, programs and/or procedures that we have adopted to monitor, control, mitigate and manage such risks. Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.


text: We are developing processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats. As our first key investment, we have hired our Director of Information Security with over 20 plus years of information security experience to oversee our cybersecurity program. Our Director of Information Security reports up to our Chief Information Officer. Together our Director of Information Security and Chief Information Officer have over 40 years of combined experience.


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We perform internal audits of our cybersecurity procedures, review data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We received ISO 27001 certification in 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Operations Officer ("COO"), to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated Grid University training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.


text: Engage Third-parties on Risk Management We engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. We require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity incident that had any significant impact on our operations or financial standing.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity".


text: Board of Directors Oversight Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Management's Role Managing Risk Our CISO and our management committee on cybersecurity, which includes our CEO, COO and IT Director, are primarily responsible to assess and manage our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our Data Protection Officer ("DPO"), HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming. Our CISO who has been leading the team for over a decade, has 20+ years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing.


text: Our CISO and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors.


text: Risk Management and Strategy The Company maintains an Information Security Program to safeguard all WSFS information assets against unauthorized use, disclosure, modification, damage, or loss. Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will: • Ensure the security and confidentiality of customer and bank records covered by law. • Protect against any anticipated threats or hazards to the security of such records. • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Customers, and Associates. • Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements. • Ensure proper and effective Business Continuity and Disaster Recovery programs are implemented and tested.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: The Company's Chief Information Security Officer (CISO) is designated as the program coordinator responsible for coordinating and overseeing the program.


text: Our Information Security Department performs annual risk assessments to evaluate the effectiveness of the controls as set forth in the Information Security Program to support the requirements under Gramm-Leach Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) Guidance on Securing Customer Information. The focus areas include: • technology systems used for information that is collected, processed and stored; • assessing internal and external cybersecurity threats and vulnerabilities; • performing regular penetration and controls testing; • evaluation and assessment of impact should the information or systems become compromised; • evaluation for the effectiveness of the governance structure for Information security risk management.


text: Internal and external Penetration Testing is performed annually. Tests are conducted or reviewed by independent third parties or qualified Associates independent of those that develop or maintain the security program. Testing is performed annually by third party auditors contracted through the Company's Risk Management Department. Management reviews test results promptly and ensures that appropriate steps are taken to address adverse test results. Remediation efforts are organized and made available to the Risk committee of the Board of Directors (Risk Committee) as well as for review by third party auditors and examiners.


text: The Company has implemented a Cybersecurity Incident Response Plan (CSIRP), which is integrated into its Master Business Continuity Plan, to identify, assess and respond to cybersecurity threats. The CSIRP provides a well-defined, consistent, and organized approach to information security related incidents and is supplemented by playbooks designed to respond to specific attacks. The CSIRP requires approval by the Executive Leadership Team under the Cybersecurity Committee and is governed by the Continuity of Operations Policy that is approved annually by the Board of Directors.


text: The Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.


text: Our Information Security Policy and Information Security Program are the standards used to protect the Bank's confidential information. The Information Security Policy is annually reviewed, updated, and approved by the Risk Committee and the Board of Directors.


text: The CISO reports security related incidents, findings, changes, etc. to the Risk Committee, on an annual basis or quarterly as needed. This information is communicated through the Company's Risk Department. The CISO has more than 25 years of experience in the information security field, including 20 years at WSFS, and holds several professional certifications and memberships in the Information Security, IT, and financial services fields.


text: The Board and Senior Management are charged with the ultimate responsibility for understanding the company's risk environment. A Management Risk Committee, chaired by our Chief Risk Officer (CRO), is responsible to oversee the Company's risk management program on an enterprise-wide basis.


text: The Company has dedicated incident management and response teams in place to facilitate response protocols and execute designed strategies necessary to mitigate business risk and support recovery initiatives. The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs. An Incident Response Task Force (IRTF) is in place to oversees the assessment of cybersecurity incidents and operational response needs. The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.


text: The CSIRP includes a framework to timely report cybersecurity incidents to our Executive Leadership Team. The severity of an incident is based on perceived impacts that include the severity of damage, compromise, or loss, and probability of further exploitation or escalation. The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be significant. based on perceived impacts of the incident or event. The Chief Executive Officer and Board of Directors are notified of these incidents by the CIO and CRO as necessary.


text: For further information on risks to the Company from cybersecurity threats, see "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses" under Item 1A. Risk Factors."


text: Astrana, like the rest of the healthcare industry, continues to innovate and rely on digital technology, further increasing the importance of cybersecurity to the business. The world is seeing an increase in cyberattacks by nation-states, hacktivists, organized cybercriminal groups, and insider threat actors, all of which may, among other avenues of attack, be using artificial intelligence ("AI") and distributed hosted environments across different geographies to attack their victims. These threat actors may be individuals or part of a cyber organized crime group that leverages large-scale Cybercrime-as-a-Service ("CaaS") subscriptions to quickly scale the impact of attacks and avoid disruption to their operations.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Company's digital systems are distributed across various architectures, including on-premises, hosted, Software-as-a-Service ("SaaS"), and other architectures operated by third-party service providers. If these architectures and third-party environments fail to operate as contracted, Astrana's systems could stop functioning for some time, placing Astrana's strategy, data, clients, and users at risk.


text: As noted in Item 1 and Item 1A of Part I of this report, a breach of Astrana's network, hosted service providers, or vendor systems may expose Astrana to a risk of loss or misuse of information, litigation, and potential liability. Therefore, the Company has a team of experienced professionals with expertise in cybersecurity leadership, risk management, incident response, and security operations overseeing Astrana's program. This team is responsible for developing and implementing our cybersecurity strategy, identifying and mitigating risks, and responding to incidents. Astrana utilizes external resources from reputable cybersecurity firms to supplement certain Chief Information Security Officer ("CISO") functions, including risk assessments, strategy, and security, while integrating these activities with Astrana's risk management processes. Astrana assesses third-party cybersecurity controls through cybersecurity questionnaires and includes security and privacy addendums to our contracts, where applicable.


text: To address cybersecurity, privacy, and overall business risk adequately, Astrana employs a consistent risk management process that assigns risks to functional owners. Risks can be strategic (e.g., loss of market share, technology shifts), reputational (e.g., loss of trust, revenue decline), regulatory (e.g., regulatory fines, business restrictions), or operational (e.g., operational downtime, productivity loss) in nature.


text: The cybersecurity team collaborates with leaders in management to assess materiality, align on a remediation roadmap, and comply with disclosure requirements. On an ongoing basis, the board of directors and the audit committee oversee Astrana's cybersecurity risks and remediation strategies to prevent and mitigate cyberattacks.


text: We have developed policies and processes for assessing, identifying, and managing material risk from cybersecurity threats informed by industry-recognized standards. We have integrated these processes into our overall risk management systems and programs. Our cybersecurity program includes, among other things: procedures to assess material risk from cybersecurity threats, protocols to monitor any potential unauthorized access to, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein, mechanisms to safeguard network infrastructure, mandatory employee training on information security, and assessing the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. As part of our risk management process, we have engaged and expect to continue to engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process is also designed to address cybersecurity risks associated with our use of third-party service providers, and includes procedures such as reviewing security audits and controls of these providers during the onboarding process.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: In connection with these risk assessments, we design, implement and maintain reasonable safeguards to minimize the identified risks and address identified gaps in existing safeguards, update existing safeguards as necessary and monitor the effectiveness of our safeguards.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity."


text: Our Board of Directors (the "Board") has oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them, and engages in discussions with management regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks. These discussions include a review of our cybersecurity-related risk assessment and risk management policies.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management, along with our information technology department, is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances. Our information technology department works with management, including the Chief Operating Officer and Chief Financial Officer, to help mitigate and remediate cybersecurity incidents of which they are notified. Our information technology department, led by our director of information technology, includes individuals with over 20 years of prior work experience in various roles involving security, compliance, systems and risk management implementation. In addition, our incident response processes include procedures for reporting material cybersecurity incidents to the Audit Committee for material cybersecurity incidents.


text: Risk Management and Strategy As a healthcare provider, cybersecurity, data protection, safeguarding patient information and the integrity of our information systems is of the utmost priority. We have developed and maintain a Cybersecurity and Data Protection Program which aligns with industry-standard frameworks and applicable regulatory requirements, integrates with our overall risk management process, and aims to ensure cybersecurity concerns are a requisite element for decision-making at all levels of our business.

companyName: RadNet, Inc.

ticker: RDNT


text: RadNet's Cybersecurity and Data Protection Program assesses, identifies and manages threats to our information systems and evaluates cybersecurity risks associated with our vendors and third-party partners. We are focused on detecting, preventing and responding to cyber threats, maintaining the privacy and protection of sensitive information, and maintaining the durability and resiliency of our information and data processing systems.


text: Our approach to designing, operating and measuring the effectiveness of our program leverages experienced internal resources, industry-recognized cybersecurity consultants, assessors, healthcare and industry-specific cybersecurity working groups and threat-intelligence platforms, federal law enforcement and CISA partnerships. We use these resources and partnerships, along with our internal expertise, to develop specialized insights pertinent to our business's cyber-risk, and tailor our cybersecurity strategy to best safeguard our systems and data.


text: We staff an internal cybersecurity team and maintain a third-party managed security operations center which in-concert provide 24x7x365 real-time detection and response. These teams are always connected and routinely respond to perceived threats within minutes. Time to detect and respond metrics are continuously evaluated for opportunities to enhance our program.


text: Cyber-awareness training and testing is a key component of RadNet's Cybersecurity and Data Protection Program. Every employee is required to complete cyber-related training (including third-parties who access our systems) and successfully complete testing throughout the year in addition to monthly phishing tests. Furthermore, we require all system users to complete annual Patient Privacy and Patient Data Breach training and testing to meet RadNet compliance standards.


text: We benchmark and evaluate our Cybersecurity and Data Protection Program and data protection maturity against the NIST Cybersecurity Framework and the HIPAA Security Rule. Consistent with these frameworks, our program includes recurring third-party assessments and a vendor risk management program. Our vendor risk management program conducts security assessments to determine a risk profile of potential vendors and third-party partners and integrates ongoing monitoring and periodic re-assessments to ensure compliance with RadNet's security standards. RadNet's Vendor Risk Management Team works closely with RadNet Legal, Compliance and Operations teams to address data safety, compliance and legal requirements for each of our vendor/partner engagements.


text: We continuously evaluate the practical effectiveness of our cyber-defenses both internally and externally using a combination of technology-based assessments and recurring third-party audits. Our Critical Incident Response Team periodically conducts cyber-focused tabletop exercises using scenarios drawn from observations of risk indicators and from threat intelligence reports of real-world incidents affecting our industry. Outcomes and insights from tabletop exercises are used to enhance RadNet's Incident Response Plan which is architected following NIST guidelines and reviewed annually and updated periodically as needed.


text: Our program's overall maturity and operational readiness are regularly evaluated internally by RadNet IT Governance and Compliance teams and by independent expert auditors using the NIST's Cybersecurity Framework. Our program, and the results of the evaluation and testing efforts, are regularly reviewed by our senior management and members of our Board of Directors.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. However, cybersecurity threats have the potential to interrupt our operations or cause significant financial hardship. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: RadNet is committed to appropriate cybersecurity governance and oversight. Our Cybersecurity and Data Protection Program is the principal responsibility of our Chief Information Officer and Chief Information Security Officer, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, RadNet's CIO and CISO work closely with our executive management, legal and compliance leaders, and meet regularly to discuss cybersecurity matters and risks.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, and internal audits of our program. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident report and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Risk Management and Strategy The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, consultants, and auditors, to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these reviews are reviewed with management and the Company's Board of Directors (the "Board").


text: Oversee Third-party Risk The Company implements processes to oversee and manage the risks inherent with third-party service providers, including conducting thorough security assessments prior to engagement. This is designed to mitigate risks related to data breaches or other security incidents originating from third party providers.


text: Incident Response The Company has implemented internal incident response procedures to address potential cyber incidents. These procedures are designed to analyze, contain, and remediate any cyber incidents that may circumvent existing safeguards. The incident response procedures encompass a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal (including the Board) and external communication and disclosure protocols. The Company also maintains data backup procedures in the event of a cybersecurity incident and for a business continuity plan in the event of business interruption. Examples of our backup procedures include regularly scheduled backups for various systems, critical system log files, and applications backup.


text: Governance & Board Oversight The cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"). The CISO plays a pivotal role in informing the audit committee and the Board on cybersecurity risks.


text: The audit committee is primarily responsible for the Board's cybersecurity risk oversight. Management, including the CISO, provide comprehensive briefings to the audit committee on cybersecurity risks on a regular basis, and the audit committee reports to the Board at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the full Board is regularly briefed on updates related Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the audit committee and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain.


text: Management's Role Managing Risk The CISO possesses more than 10 years of relevant expertise in cybersecurity; and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA").


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, Head of Internal Audit, and Internal Communications, to evaluate cybersecurity risks in alignment with our business objectives and operational needs.


text: The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to ensure the efficacy of our security measures.


text: Furthermore, the program includes a formal information security training program that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statement of Operations for the year ended December 31, 2023, and the reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."


text: The Company has a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Cybersecurity Risk Identification and Management We design and assess our program based on the Center for Internet Security Critical Security Controls Version 8 (CIS V8). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS V8 controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor-Risks Related to Our Stores and Operations-We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: The Company is able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, the Company's designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.


text: In the event of a cybersecurity breach, our primary objective is to swiftly contain it by the procedures detailed in our IRP. Once containment is achieved, our focus shifts to remediation and recovery efforts. These actions are tailored to the specifics of the breach and may involve tasks such as rebuilding systems or hosts, replacing compromised files with clean versions, verifying the integrity of affected files or data, enhancing network surveillance or logging to detect future attacks, adjusting administrative account privileges, fortifying network security like firewall configurations, and providing additional training to employees. Additionally, we carry cybersecurity insurance to cover certain expenses associated with security lapses and specified cyber incidents that disrupt our network or those of our vendors, subject to predefined limits and exclusions.


text: Our IRP includes clear communication guidelines, outlining procedures for engaging executive management, internal and external legal counsel, the Audit Committee, and the Board. These protocols also encompass a framework for evaluating our regulatory reporting obligations to entities such as the SEC in the aftermath of a cybersecurity incident.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.