text: The Company's Risk Management Committee (RMC), which is chaired by the Chief Policy and Risk Officer, evaluates risks relating to cybersecurity, among other significant risks, and oversees mitigation plans. The RMC is comprised of executive leadership across multiple functions, including individuals with responsibilities and oversight over legal, regulatory, finance and treasury, operations, information technology, business development, and policies and controls. The RMC meets monthly and receives regular updates on security performance metrics, global security risks, security enhancements, and updates on our security posture.


text: The Company has a cross-functional cybersecurity incident response team ("CIRT"). The Company's CIRT routinely reviews and updates our incident response plans, procedures and protocols, as well as reports to the Company's RMC on security matters that impact the confidentiality, integrity, or availability of the Company's data or information systems.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK

secItem: Item 1C


text: Our industry is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A, "Risk Factors," in this Annual Report on Form 10-K for additional information regarding the risks related to cybersecurity threats.

companyName: Marqeta, Inc.

ticker: MQ


text: Our Chief Information Security Officer ("CISO") is responsible for Marqeta's information security posture and cybersecurity program. We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on over 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military. Our CISO reports to our Chief Technology and AI Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.


text: Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third-party consultants. Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.


text: We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems. We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the criticality of such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address identified gaps in existing safeguards. These safeguards include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data. We also employ limited system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructure. As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.


text: We periodically engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.


text: Risk Management and Strategy Management has established policies and processes to identify, analyze, mitigate, and manage cybersecurity risks relevant to our platform, and has integrated these processes into the Company's overall risk management processes. Various types of risks are considered, including, but not limited to, fraud, technological, compliance, and vendor risks. Our program for assessing, identifying, and managing material risks from cybersecurity threats includes the following key controls: • To protect our systems and applications, we maintain endpoint security protection on all employee laptops and desktops, including industry-standard firewalls, monitoring, and intrusion detection practices. • We require multi-factor authentication to access our critical systems and applications. • We employ strong password standards for our systems and applications. We also employ firewalls across our infrastructure to guard against threats. • We provide ongoing security training to our employees and contractors about information security policies and practices, including phishing simulations. • Our process for managing third-party risk includes security assessments of key third-party service providers before entering into or renewing business with them or granting them access to our data or information systems. Additionally, we impose contractual restrictions on these providers based on their risk profile. • We maintain enterprise-wide policies and procedures for reporting and managing security incidents, including prompt reporting of all incidents. We perform incident response simulations on at least an annual basis.

companyName: Ibotta, Inc.

ticker: IBTA


text: We engage with independent third-party auditors to perform SOC2 assessments on an annual basis. We also engage with a third party to conduct penetration testing at least annually to identify threats and assess their potential impact to system security. Any vulnerabilities identified in this process are triaged by our information security team and handled in accordance with our vulnerability management process.


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," including the section titled, "If our security measures or information we collect and maintain are compromised or publicly exposed, publishers, CPG brands, retailers, and consumers may curtail or stop using our platform, and we could be subject to claims, penalties, and fines."


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Ou r Chief Technology Officer oversees our security team, which is responsible for our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The security team consists of experienced engineers and analysts. All senior members of the team have industry recognized accreditations or commensurate experience. Our security team meets at least weekly and holds quarterly meetings with cross-functional leadership to report on cybersecurity risks and threats.


text: Representatives from our security team provide quarterly updates to the Audit Committee and/or Board of Directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Governance: As discussed in more detail below under the heading "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews operational risks. Our Senior Director, IT Application & Compliance and Interim Head of Information Technology ("HIT"), together with our Head of Information Security ("HIS"), and other members of our management team meet regularly to review current cybersecurity risks. The HIT and management team representatives also meet with the Audit Committee at least on a quarterly basis to discuss and review our cybersecurity program and risk landscape.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Our Board, in coordination with the Audit Committee, oversees our risk management approach, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent expert reviews, the threat environment, technological trends, and any material risks identified with our third parties. The Audit Committee also receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been remediated. Our HIT, Audit Committee and Board review and discuss our approach to cybersecurity risk on an annual basis.


text: The HIT and HIS, in coordination with our management team, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Through an ongoing process, the HIS monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the HIT, management team, and when appropriate, the Audit Committee.


text: Selected Management and Director Qualifications The HIS and HIT have both served in various roles in information technology and information security for many years, including serving in similar roles at other publicly traded companies. The HIS holds several industry accreditations, including being a certified Chief Information Security Officer, and has worked in the information technology field for over 25 years, specializing in Information Security for the last 15 years. The HIT has an undergraduate degree in computer science and business administration and has worked in healthcare information technology for over 20 years. Our CEO, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at VirBio and at similarly situated companies, including risks arising from cybersecurity threats. For example, our CFO has been responsible for leading and managing Information Technology departments at two separate publicly traded companies, including our Company, and has leadership experience in business continuity planning in various roles. Additionally, one of our directors formerly served as the United States Secretary of Homeland Security, in which capacity she had ultimate responsibility for the cybersecurity of the critical infrastructure of the United States of America, and as President of the University of California with responsibility for cybersecurity matters related to the university's various networks.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, and implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including supervision, mitigation, and disclosure of risks from cybersecurity threats.


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and the Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.


text: TIAA's management team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cybersecurity attack disrupts the Company's critical operations, service or financial systems. See "Item 1A — Risk Factors — Risks Related to our Business and Operations — Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which is augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Our CISO has over 18 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity awareness trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers is on a limited basis and is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the near future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements by the time it becomes fully rolled out in 2028.


text: To date, we do not believe risks from c ybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us or are reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K.


text: As part of our enterprise risk management program, which is overseen by the audit and risk committee, we identify and review risks related to cybersecurity on a regular basis, including risks related to third-party access to our information technology systems. We conduct periodic enterprise risk assessments and report the results to the executive team and the audit and risk committee.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our chief technology officer, with 14 years of experience in information technology, artificial intelligence and software engineering, is responsible for managing and assessing risks related to cybersecurity and data governance. Our chief technology officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. Our chief technology officer supervises our vice-president of information technology, who has primary operational responsibility for managing the overall cybersecurity posture and strategy, managing internal and external cybersecurity resources and organizing and leading efforts to prevent, detect and respond to cybersecurity incidents and threats. Prior to joining the company, our chief technology officer previously served in various data and technology leadership roles, including most recently as chief data officer at another biotechnology company. Our vice-president of information technology has 25 years of experience in information technology and most recently served as senior director of information technology operations and infrastructure at another biotechnology company. As part of our quarterly disclosure committee process, our chief technology officer discusses with our chief executive officer, chief financial officer and other members of the disclosure committee, any significant cybersecurity issues, including any potential risks related to cybersecurity incidents.


text: Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into our overall enterprise risk management system. We have developed and implemented policies, procedures and practices designed to protect the information and systems that support our operations and assets. In developing our policies and procedures, we were informed by certain industry standards and guidelines. We routinely train our employees on cybersecurity awareness and our information security and data protection policies.


text: We have policies and procedures designed to prevent, detect and respond to cybersecurity incidents or threats. We use industry standard security and monitoring systems that are managed by our internal information technology team with support from third-party IT services firms. We also periodically conduct security testing or hire third-parties to conduct security testing, such as phishing testing and penetration testing. The results of our security testing are reported to our chief technology officer and, when relevant, with the wider executive team.


text: When engaging third-parties, we have procedures and protocols designed to protect our information technology systems and our confidential information. For example, before we grant third-parties access to our information technology systems, we require typically agreements with such third-parties, we ordinarily require such third parties to complete cybersecurity training and we typically require specific contract terms in our agreements with such third-parties.


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incident that could adversely impact our ability to operate our core business functions. As a real estate finance services firm, we do not maintain a significant level of personally identifiable information data, so our exposure to data breaches is limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to our data and systems, including from malicious software and computer virus attacks. We anticipate we will continue to face similar threats, including attempts for unauthorized access, in the future. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents, though coverage may not be available or sufficient to cover costs of certain cybersecurity incidents.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Risk Management and Strategy We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a robust cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls, including endpoint and network monitoring, endpoint protection, and network security measures, safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling cybersecurity incidents involving assets or data. It guides our cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework for timely communication to relevant parties, that may include our management team, Board of Directors and Audit Committee, based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel can identify and analyze threats.


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted to support the identification of risks. We also conduct independent audits, including through the use of third-party assessors on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.


text: An external vendor risk management platform is utilized to evaluate, rate, monitor, and track vendor risk pertaining to our critical vendors. The security practices and processes of the service providers are monitored regularly, and periodic assessments may be performed on the service providers'compliance with cybersecurity terms, based on the service providers' risk. For any of our hosted applications we by default require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. The Board and Audit Committee also may receive updates on topics such as the results of various cybersecurity assessments, third party risk management, and evolving risks.


text: Trulieve recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of the data we produce and collect.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and the Audit Committee of our Board of Directors (the "Board"). We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our cybersecurity program follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure that our cybersecurity risks fully integrate into the Company's overall risk management approach.


text: Third-party Risk Management and oversight As part of our cybersecurity program, we engage with external service providers in our continuing cybersecurity efforts. These providers assist us in evaluating and enhancing the effectiveness of our information security policies and procedures. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges with a material impact on our strategic plan, operations, or financial standing. For additional information, see "Item 1A. Risk Factors - We are subject to security risks related to our products as well as our information and technology systems".


text: Trulieve's cybersecurity program is managed under the management purview of our Chief Technology Officer (" CTO ") and our Senior Director of Information Security, whose team (the "Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our CTO has over 20 years of experience with large information technology footprints, including cybersecurity. His in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Information Security Governance Committee ("the IT Committee") and the Audit Committee of our Board of Directors oversee management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee comprises board members with diverse expertise equipping them to oversee cybersecurity risks effectively.


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our IT Committee and Audit Committee, our Chief Executive Officer, and other members of senior management as appropriate.


text: The IT and Audit committees actively participate in discussions with management regarding cybersecurity risks. The IT Committee and Audit Committee assess the Company's cybersecurity program at least annually, including discussing management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the IT and Audit Committee and appropriate senior management levels maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.


text: Papa Johns' cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. Our cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats, effective management of cyber risks, and resilience against cybersecurity incidents. Our program leverages industry frameworks, including the Payment Card Industry (PCI) Standards and the Center for Internet Security (CIS) security framework.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: The Audit Committee provides oversight of our cybersecurity program, which includes annual and periodic reviews of our cybersecurity program and cybersecurity risks. As part of its oversight responsibility, and pursuant to its charter, the Audit Committee reviews with management and reports to the full Board with respect to significant cybersecurity matters and risks and management's actions to monitor and address identified issues. The Internal Audit team also meets periodically with the VP, Information Security and Compliance officer along with key IT leadership to discuss open cyber or data security risks. This effort is to help ensure items of risk are addressed and resolved in a timely manner. The Audit Committee receives updates from the Company's recently appointed Chief Digital and Technology Officer ("CDTO"), VP, Information Security and Compliance, and/or members of our executive leadership team. Management also reports to the full Board at least annually regarding a comprehensive overview and status of the Company's information security program. The Audit Committee is also apprised of cybersecurity incidents consistent with the provisions of our recently enhanced cybersecurity incident response plan ("IRP") pertaining to escalation of more significant cybersecurity incidents.


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Cyber Oversight Group, led by our CDTO and VP, Information Security and Compliance. Our CDTO has decades of experience as Chief Technology Officer with multiple companies, and significant expertise in enterprise architecture, engineering, analytics and digital technology. In addition, our VP, Information Security and Compliance has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CDTO and VP, Information Security and Compliance are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.


text: Members of our Cyber Oversight Group also include our Chief Executive Officer, Chief Financial Officer, Chief Legal and Risk Officer, Senior Director of Internal Audit, VP of International Technology, and technology and data privacy in-house counsel. The Cyber Oversight Group is also tasked with reporting to the Audit Committee on cybersecurity risk management strategies, as well as any significant cybersecurity incidents that may occur. In addition, the Cyber Oversight Group meets at least four times per year, or with greater frequency as necessary, to, without limitation: • review with management the Company's cybersecurity threat landscape, risks, and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies as to risk assessment and risk management, including the guidelines and policies established by the Company to assess, monitor, and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, technology and information systems, including cybersecurity incident response preparedness, communication plans, and disaster recovery capabilities.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Cyber Oversight Group utilizes the IRP to: (1) prepare for and protect against cybersecurity incidents; (2) identify and analyze cybersecurity incidents; and (3) contain, eradicate, and help ensure appropriate reporting of cybersecurity events in accordance with our regulatory obligations. In the event of a cybersecurity incident, the IRP provides a framework to coordinate the response. The IRP also addresses escalation protocols to senior management responsibility with respect to disclosure determinations and provides for Audit Committee and Board briefings as appropriate. We also manage threats to our systems originating or associated with third party service providers by integrating cybersecurity requirements and other related obligations into various contracts. We also utilize vendor intake evaluations, ongoing cyber risk monitoring of our critical technology vendors, and and other risk management strategies to evaluate and help mitigate risk associated with our third party service providers. Vulnerabilities and risks identified for our third-party vendors are handled through ongoing scanning and reviews.


text: We employ a variety of measures to prepare for and protect against, detect, and contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures we have in place include, without limitation, password protection, multi-factor authentication, internal and external penetration testing, maturity assessments, industry benchmarking, and annual cybersecurity awareness trainings for our employees as well as social engineering awareness simulations. The security operations program includes an outsourced managed security detection and response service, augmenting the internal security staff with additional third-party dedicated staff and an expert security advisor. Our IRP sets forth the process we follow to investigate a potential or confirmed cybersecurity incident and contain it as well as to assess disclosure obligations and address remediation, eradication, and recovery, with such efforts dependent upon on the nature of the cybersecurity incident. We have relationships with a number of well-established third-party service providers to assist with cybersecurity incident response, containment and remediation efforts. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity incidents that impact our own systems, networks, and technology. While we maintain a robust cybersecurity program, the techniques used to attack or impact information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."


text: Although risks from cybersecurity threats to date have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are managed by our Director of Information Technology, in consultation with the legal and human resources teams. The Director of Information Technology has primary responsibility for day-to-day management of our cyber risk management program, including monitoring for cybersecurity risks. Currently, the Director of Information Technology role is held by an individual who has over 18 years of cybersecurity, information technology, and systems engineering experience. The Director of Information Technology reports to the Chief People Officer.


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports on cybersecurity risks to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis. Further, in accordance with the committee's charter, the chair of the audit committee provides periodic updates on committee activities to the full board of directors, which may include discussion of any cyber risks.


text: Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see "Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business," which is incorporated by reference into this Item 1C.

companyName: Vericel Corp

ticker: VCEL


text: In the three most recently completed fiscal years and as of the date of this Annual Report on Form 10-K, we have not experienced any material cybersecurity incidents. Additionally, we do not believe any previous cybersecurity incidents we may have experienced are reasonably likely to materially affect us. This includes cybersecurity incidents resulting in penalties and settlements, of which there were none.


text: The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives. The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board's legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022, 2023 and 2024 in overseeing the development of the Company's Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.


text: Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats. Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities. In this role, our Executive Director, Corporate Information Systems works closely with an internal team that includes resources with various cybersecurity certifications and leverages the support of our external information security firm, technology partners and an industry-leading intelligence platform. Our Executive Director manages and leads the internal Information Technology team to maintain, update and enhance the Company's technology infrastructure and corresponding safety measures, as well as to ensure that appropriate safety measures are implemented to protect against evolving cybersecurity threats.


text: Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.


text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. We may also maintain cyber liability insurance that covers certain damages caused by cybersecurity incidents. However, there is no guarantee that adequate insurance will continue to be available at rates that we believe are reasonable or that the costs of responding to and recovering from a cybersecurity incident will be covered by insurance or recoverable in rates. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Each of our Audit Committee and Board is informed of such risks through reports from our Chief Information Officer ("CIO") at least twice per year.


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for seven years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows: • The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents. • The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team. • The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation. • The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures. We also restrict vendors' access to our organizational systems through a segmented and controlled environment which is monitored by us, and perform detailed and customized risk assessments of certain vendors, including their ability to protect data from unauthorized access.


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2024, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: Risk Management and Strategy Our information security program is led by our chief information security officer ("CISO"), who has over 25 years of experience in technology management, has 9 years of banking experience, and is a certified information systems security professional. The CISO oversees our "information security team" within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents. In addition to our information security team, we also employ a senior vice president of IT governance and risk who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators ("KRIs"), including KRIs related to cyber risks. Both our CISO and our senior vice president of IT governance and risk report to our chief information officer ("CIO"), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor "Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impacts on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us." in "Item 1A. Risk Factors" of this Form 10-K for more information.


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures, which are designed to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT audit, IT security, governance, risk, and compliance reviews. To protect, detect, and respond to cybersecurity threats, we aim to conduct the following activities at various intervals during the year, which vary in maturity across our business: • Regular network and endpoint monitoring; •24x7 security operations monitoring of our systems, networks, and services to detect and act on weaknesses and potential intrusions;


text: • Role-based access controls to identify, authenticate, and authorize individuals to access systems based on their job responsibilities; • Business resiliency planning with disaster recovery and business continuity testing; • Testing of new products and services and major changes to existing products and services to identify potential security vulnerabilities before release; • Protection, including encryption, for the secure communication of sensitive data; • Regular, proactive privacy and cybersecurity reviews of systems and applications, including third-party security practices; • Auditing of applicable data policies; • Regular internal and external security audits and penetration tests by third-party security vendors, as well as internal offensive team penetration testing; • At least annual security awareness training and testing of our employees; and • Monitoring emerging laws and regulations related to data protection and information security and implementing appropriate changes.


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We have also obtained industry certifications and attestations.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our enterprise operations, compliance, and legal teams, including our Chief Information Officer, Chief Information Security Officer, and Chief Legal Officer. Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the cybersecurity sub-committee. With over a combined 50 years of experience in the field of cybersecurity, the cybersecurity sub-committee brings a wealth of expertise to their role. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our cybersecurity sub-committee oversees our cybersecurity strategies, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Monitor Cybersecurity Incidents The cybersecurity sub-committee stays apprised about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity sub-committee implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the cybersecurity sub-committee is equipped with a well-defined incident response plan, which provides a framework to mitigate the impact of cybersecurity incidents.


text: The cybersecurity sub-committee regularly informs the risk management committee of matters related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the audit committee and board of trustees, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Seadrill is dedicated to upholding comprehensive cybersecurity policies and procedures to safeguard our assets, data, and stakeholders. We achieve this by continuously assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program is built upon the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Cybersecurity risk is an integral part of our Enterprise Risk Management ("ERM") program, which evaluates potential impacts to our operations, financial stability, and reputation.

companyName: Seadrill Ltd

ticker: SDRL


text: The Vice President of Technical Services serves as the Senior Management sponsor for cybersecurity risk and mitigation plans. Day-to-day management of cybersecurity risks falls under the responsibility of the Director of Information Security and Information Technology ("ISIT") and the Cybersecurity Manager. Our Cybersecurity Manager is a retired U.S. Military Cyber Warfare Officer with over 15 years of experience in Cybersecurity Operations and a member of the International Association of Drilling Contractors Cybersecurity Committee.


text: The governance of Seadrill's cybersecurity program is detailed in Directives and Procedures within our Management System. These documents are regularly reviewed and outline the roles of our Cybersecurity Steering Committee, Security Operations Center, and our comprehensive Cyber Incident Response Plan. This plan specifies procedures for assessing the risk of foreseeable cyber incidents, escalating incidents to Senior Management (including necessary disclosures), and systematically responding to incidents through isolation, containment, analysis, and resolution. A structured de-escalation process follows these actions to ensure resolution and recovery. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or with access to our systems or data. We evaluate key third-party providers' cybersecurity postures and may recommend specific mitigation controls. The Company works with various assessors, consultants, auditors, and other third parties on a regular basis to ensure the effectiveness of our cybersecurity measures.


text: To maintain and enhance the strength of our cybersecurity controls while reducing risk exposure, Seadrill conducts vulnerability assessments and penetration testing. As a principal risk, cybersecurity is also included in our rolling Internal Audit & Assurance program and is subject to external ISO 9001 quality management certification, certified by DNV. Oversight of these efforts is provided by the Assurance, Quality & Enterprise Risk Function, which ensures the robustness of key mitigations and controls.


text: Senior Management oversee the cybersecurity program through weekly and monthly updates, and report on the cybersecurity program to the Audit and Risk Committee for oversight, on a quarterly basis. Additionally, cybersecurity risks are reviewed annually as part of the ERM program. The ISIT Function leads ongoing training and awareness initiatives that applies to all Seadrill personnel, including employees, contractors and contingent workers, emphasizing cybersecurity as a critical organizational priority and mitigating the potential human factor in cyber incidents.


text: To date, Seadrill's business strategy, operations, and financial condition have not been materially affected by large-scale cybersecurity threats or incidents. For more information on the risks related to Cybersecurity, please refer to Part I, Item 1A, "Risk Factors - Risks Relating to Our Business and Industry - Failure to adequately protect our sensitive information, operational technology systems and critical data, or our service providers' failure to protect their systems and data could have a material adverse effect on us."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of the board of directors oversight of cybersecurity risks. The audit committee oversees management's implementation of our cybersecurity risk management program.

companyName: FIGS, Inc.

ticker: FIGS


text: The audit committee receives regular reports from management, including our Chief Technology Officer ("CTO") and Senior Director of Information Security. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our management team, including our CTO and Senior Director of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. Our management team, including our CTO and Senior Director of Information Security, also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our CTO's background includes 14 years of experience leading technology at several eCommerce companies and our Senior Director of Information Security has 16 years of experience in the field of cybersecurity, including extensive experience as head of information security at public and private companies. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: Cybersecurity Risk Management and Strategy The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats. This program scores, ranks, and reports risks to Company managemen t based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools. We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders. Internally, we regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of third-party consultants.


text: The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers. This process includes, as appropriate, conducting assessments of third-party providers' cybersecurity capabilities and reviewing third party providers' processes for alignment with our internal cybersecurity requirements.


text: Cybersecurity Governance The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. Together, our CLO and IT team have over 40 years of industry experience in implementing and managing information technology and information security systems, and members of our IT team maintain Certified Information Security Manager certifications. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, the risks and prevention of cybersecurity threats. Cybersecurity incidents are escalated based on defined incident severity criteria to management. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board of Directors (Board).


text: Management is responsible for the day-to-day management of risks we face, while the Board as a whole and through its committees, provides guidance on the oversight of risk management.


text: The Audit Committee reviews the effectiveness of the Company's governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management. The Audit Committee, at least annually, reviews and considers the results of our ERM process, including as it relates to risks from cybersecurity threats, and provides updates, as appropriate or required, to management and the Board.


text: We have not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: HESS CORP


text: Additional information about cybersecurity risks we face is discussed in Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by the Corporation or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: We conduct regular risk assessments to identify cybersecurity threats. We also conduct assessments as part of our regular process in the event of a material change in our business practices or established procedures that may affect information systems, which are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We regularly perform internal audits of our cybersecurity procedures, review role-based data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We have maintained our ISO 27001 certification since 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits. During the year ended December 31, 2024, we completed the transition to the latest version of the standard and added two additional locations to the certification scope.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We incorporate results of these risk assessments to our policies and procedures, to maintain reasonable safeguards on an ongoing basis to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated "Grid University" training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.


text: Engage Third-Parties on Risk Management We typically engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. To address and mitigate potential risks associated with our use of such third parties, we require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity events, including cybersecurity incidents, that have had or which are likely to have any material impact on our business strategy, results of operations or financial position.


text: For additional information regarding risks related to cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity."


text: Board of Directors Oversight Our board of directors is responsible for monitoring and assessing strategic risk exposure, including cybersecurity risks, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Management's Role Managing Risk We devote significant resources, and designate high-level personnel, including our Chief Information Security Officer ("CISO") and Data Protection Officer ("DPO"), who each report to our Chief Operations Officer ("COO"), to manage cyber-related risk assessment and mitigation processes. Our CISO, who has been leading the team for over a decade, has over 20 years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing Our CISO and our management committee on cybersecurity, which includes our Chief Executive Officer ("CEO"), COO and IT Director, are primarily responsible for assessing and managing our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our DPO, HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming.


text: Our CISO and management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our formal information security program includes measures to address: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness. Through these measures, our CISO and management committee on cybersecurity are informed about and monitor the lifecycle (i.e., prevention, detection, mitigation, and remediation) of cybersecurity threats or incidents.


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors. There is also an annual senior management meeting and report to our CEO and COO that follows our internal information security audit, which is overseen by the CEO.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company's business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business."

companyName: Rocket Lab Corp

ticker: RKLB


text: Governance of Cybersecurity Risk Management Our Board of Directors (the "Board") holds collective oversight responsibility for our strategic and operational risks. Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management. The Audit Committee provides periodic reports on these reviews to the full Board of Directors.


text: Risk Management and Strategy We identify and assess areas of risk for our business on an ongoing basis, and we have developed, and regularly update and refine, comprehensive practices to manage and mitigate existing and potential risks to our business. As part of that process, we continually identify and assess areas of cybersecurity risk for our business using the National Institute of Technology Cybersecurity Framework 2.0 ("NIST CSF 2.0 Framework"). We have an information security risk management framework that has processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management includes the following elements: • a team dedicated solely to cybersecurity which is managed by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Digital and Transformation Officer ("CDTO"); • a third party risk management process that includes cybersecurity assessments of third party products and systems proposed to connect to our information systems environment or access or store our data; and • a cybersecurity incident response plan.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our cybersecurity team, which includes both our employees and those of our managed services providers, is comprised of people with various functional areas of responsibility, including personnel from our information technology, operations, legal, compliance, risk management, communications, incident command center, security, human resources, finance and internal audit teams. We have contracted with a Security Operations Center service provider and a Managed Detect and Response service provider; both of which are staffed 24 hours a day to provide monitoring and active protection support for our cybersecurity risk management program. Our senior security leadership team has significant experience with data security, and members have served in various roles within our security program.


text: We have devised a multi-faceted approach to assess, identify, protect, detect, respond to and recover from cybersecurity threats using the NIST CSF 2.0 Framework. We have implemented numerous threat management tools and processes, and developed disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also regularly conduct table-top exercises, which serve to simulate cybersecurity incidents to practice our response and identify gaps. We routinely perform security risk assessments using internal and external services, including internal and external penetration testing.


text: We also require all employees to complete cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.


text: Our business requires us to share data, and have our systems interact, with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors. This interaction and sharing of data creates risks to our systems and makes us vulnerable to third party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies and includes cybersecurity team assessments of third party products and systems proposed to connect to our information systems or access or store our data. A subgroup of our cybersecurity team is dedicated to risk assessment analyses of vendor security practices and protections. We leverage the FAIR (Factor Analysis of Information Risk) model to help quantify the third party's cyber risk. We endeavor to incorporate security measures into contracts with vendors. In addition to protecting our assets and systems, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan, updated annually, that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management. We have a cybersecurity incident response team composed of a smaller, core group of our cybersecurity team. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.


text: Management Oversight— Management is responsible for the day-to-day handling of risks facing our Company, including cybersecurity risks. Our CISO, who reports directly to our CDTO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CDTO and other members of senior management, who, in turn, report them to our Board and Audit and Compliance Committee, as appropriate. Our CISO joined us in January 1998 with 13 years of experience in various technology and information security roles within Ardent.


text: Board Oversight—Our Board of Directors (the "Board"), as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee. Our Board has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CDTO and the CISO, on various cybersecurity matters, including the security of our information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The Board's Audit and Compliance Committee receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the Audit and Compliance Committee, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit and Compliance Committee.


text: In November 2023, we experienced the Cybersecurity Incident, which temporarily disrupted our operations and involved the exfiltration of certain confidential employee and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following the Cybersecurity Incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including, among other things, enhancing the visibility of our Security Operations Center, training practices, detection tools and capabilities, and implemented new tools and processes, expanded the scope of vulnerability management, and increased scrutiny of internet access. In addition, we adopted several technologies that incorporate artificial intelligence capabilities to enhance our protection capabilities. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.


text: Except for the Cybersecurity Incident, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may not be sufficient to cover all insured losses or all types of claims that may arise.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is staffed by a team of skilled cybersecurity professionals, including ~20 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts.

companyName: Crane Co

ticker: CR


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our internal training process, we maintain annual training for all employees on cybersecurity standards, as well provide monthly trainings on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. The Company uses advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we regularly engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.


text: Crane Company was separated from its parent company, Crane Holdings, on April 3, 2023, and since the separation and during the preceding 5 years as Crane Holdings, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. The Company maintains cyber risk and related insurance policies as a measure of added protection.


text: Cybersecurity Governance The cybersecurity program is led by Crane Company's Chief Information Security Officer, who regularly reports to our executive team about our program, including a review of cyber threat trends, our information security organization and staffing, and the status of ongoing efforts and investments to strengthen our cybersecurity defenses.


text: We utilize a risk-based, multi-layered information security framework following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented a systematic approach measuring ourselves against this multi-layered framework which we formally review on a quarterly basis (monthly updates as necessary) to identify and mitigate security risks that we believe are commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. In addition, we provide a minimum of two formal program updates each year to the Audit Committee of our Board of Directors.


text: Our strict protection and security measures have resulted in zero security incident-related disruptions or downtime to our business continuity. However, there is no guarantee that a future security incident would not materially affect our business strategy, results of operations or financial condition. See "Risk Factors" beginning on page 13 of this Form 10-K.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Alignment's cybersecurity organization is led by David MacLeod, our Chief Information Security Officer, who is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and reports to Robert Scavo, our Chief Information Officer, as well as to the Audit Committee. Mr. MacLeod has served as our CISO since December 2022, has over 26 years of diverse leadership experience in the healthcare information space (including over 20 years as a certified information systems security professional and chief information security officer) and holds advanced degrees in information technology management and computer science.


text: Risk Management and Strategy We are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through cybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity defenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against misuse, intrusions and cyberattacks and to protect the data we collect. Our processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into our overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. Our information security program maintains procedures and controls for the systems, applications and our data and data of our third-party providers. We have an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others and educate employees on mechanisms in place to report cybersecurity incidents or suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident response plan, which is managed by our C hief Information Security Officer (CISO) and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide platform that allows us to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: Our information security program is designed to generally align with recommended practices in security standards issued by the International Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.